TI-2026-26825 CVE-2026-34577
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
Priority HIGH 76
Postiz is an AI social media scheduling tool.
gitroomhq
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
gitroomhq records in CISA KEVNo gitroomhq vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records in Postiz · all components
TI-2026-28982 CVE-2026-40168
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
Priority HIGH 75
Postiz is an AI social media scheduling tool.
TI-2026-29238 CVE-2026-40487
Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
Priority HIGH 74
Postiz is an AI social media scheduling tool.
TI-2026-26824 CVE-2026-34576
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
Priority HIGH 69
Postiz is an AI social media scheduling tool.
TI-2026-26837 CVE-2026-34590
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
Priority MEDIUM 58
Postiz is an AI social media scheduling tool.
TI-2026-30607 CVE-2026-42298
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
Priority MEDIUM 49
Postiz is an AI social media scheduling tool.
TI-2026-30836 CVE-2026-42556
Postiz stored XSS in public preview page
Priority MEDIUM 40
Postiz is an AI social media scheduling tool.