Read the docs
TI-2026-30649 Aliases CVE-2026-42346

Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths

Priority LOW 28CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Fix Fixed postiz-app (gitroomhq): 2.21.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitroomhqpostiz-app2.16.6 to before 2.21.72.21.7Patch availableCNA
  • postiz-app Vendorgitroomhq Affected 2.16.6 to before 2.21.7 Fixed in 2.21.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*——gitroomhq
  • cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:* Versions — — ·gitroomhq

Remediation

  • Fix · CNA postiz-app (gitroomhq) Fixed in 2.21.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42346

References

Other 3

  • TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
  • TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
  • TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
  • TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
  • TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
  • TI-2026-15715 Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover CVSS 4.0CRITICAL 9.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences