CVE-2026-34576: high-severity vulnerability in gitroomhq postiz-app
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.3epss 0.3%
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension check (.png, .jpg, etc.) which is trivially bypassed by appending an image extension to any URL path. An authenticated API user can fetch internal network resources, cloud instance metadata, and other internal services, with the response data uploaded to storage and returned to the attacker. This issue has been patched in version 2.21.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
gitroomhq · postiz-appRelated CVEs — gitroomhq postiz-app
In the same product, most dangerous first.
CVE-2026-19264CRITICALUnauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeoverEPSS 1.0%CVE-2026-42298CRITICALPostiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.devEPSS 0.5%CVE-2026-34577HIGHPostiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension CheckEPSS 0.5%CVE-2026-40168HIGHPostiz has Server-Side Request Forgery via Redirect Bypass in /api/public/streamEPSS 0.4%CVE-2025-53641HIGHPostiz allows header mutation in middleware facilitates resulting in SSRFEPSS 0.3%CVE-2026-42556HIGHPostiz stored XSS in public preview pageEPSS 0.3%