Read the docs
TI-2026-30836 Aliases CVE-2026-42556

Postiz stored XSS in public preview page

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Fix Fixed postiz-app (gitroomhq): 2.21.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitroomhqpostiz-app2.21.6 to before 2.21.72.21.7Patch availableCNA
  • postiz-app Vendorgitroomhq Affected 2.21.6 to before 2.21.7 Fixed in 2.21.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitroom:postiz:2.21.6:*:*:*:*:*:*:*2.21.6Vulnerablegitroomhq
  • cpe:2.3:a:gitroom:postiz:2.21.6:*:*:*:*:*:*:* Versions 2.21.6 Vulnerable ·gitroomhq

Remediation

  • Fix · CNA postiz-app (gitroomhq) Fixed in 2.21.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42556

References

Advisory 1

Other 1

  • TI-2026-26825 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVSS 3.1HIGH 8.6
  • TI-2026-28982 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVSS 3.1HIGH 8.2
  • TI-2026-29238 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVSS 3.1CRITICAL 9.0
  • TI-2026-26824 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVSS 4.0HIGH 8.3
  • TI-2026-26837 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVSS 3.1MEDIUM 5.4
  • TI-2026-30607 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences