Read the docs
TI-2026-28982 Aliases CVE-2026-40168

Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream

Priority HIGH 75CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied URL and blocks direct private/internal hosts, it does not re-validate the final destination after HTTP redirects. As a result, an attacker can supply a public HTTPS URL that passes validation and then redirects the server-side request to an internal resource.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed postiz-app (gitroomhq): 2.21.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitroomhqpostiz-appbefore 2.21.52.21.5Patch availableCNA
  • postiz-app Vendorgitroomhq Affected before 2.21.5 Fixed in 2.21.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*before 2.21.5Vulnerablegitroomhq
  • cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:* Versions before 2.21.5 Vulnerable ·gitroomhq

Remediation

  • Fix · CNA postiz-app (gitroomhq) Fixed in 2.21.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40168

References

Exploit 1

Patch 1

Other 1

  • TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
  • TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
  • TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
  • TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
  • TI-2026-30607 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev CVSS 3.1CRITICAL 10.0
  • TI-2026-30836 Postiz stored XSS in public preview page CVSS 3.1CRITICAL 9.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences