CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-19264

Postiz is an open-source social media scheduling tool affected by CVE-2026-19264. The vulnerability arises in the route that serves locally stored media, which concatenates URL path segments into the upload directory and streams files without proper path normalization or directory confinement. UR...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-19264 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

CVE-2026-18050 Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads

The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy,...

rowboat 访问控制错误漏洞

rowboat is an AI-driven multi-intelligence builder open-sourced by RowBoat Labs. An access control error vulnerability exists in rowboat, which stems from missing authentication in the file apps/rowboat/app/api/uploads/fileId/route.ts...

CVE-2021-45040

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...

CVE-2021-45040

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...

CVE-2021-45040

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...

Design/Logic Flaw

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...

CVE-2021-45040

The Spatie media-library-pro library through 1.17.10 and 2.x through 2.1.6 for Laravel allows remote attackers to upload executable files via the uploads route...

PT-2022-12299

Name of the Vulnerable Software and Affected Versions Spatie media-library-pro library versions 1.17.10 and earlier Spatie media-library-pro library versions 2.x through 2.1.6 Description The issue allows remote attackers to upload executable files via the "uploads route" API endpoint. This can b...