CVE-2026-115932: Posts Service Ts Cwe 918 Cve 2026 115932cve-2026-115932-posts-service-ts-cwe-918-cve-2026-115932
A value classified as a local file reaches a filesystem read without canonicalization and containment validation. A stored, user-influenced media path (recorded from a request and later prefixed with the upload directory) can contain `..` segments or be absolute, so the worker reads any file the process can access and the provider then uploads those bytes to
