CVE-2026-42556: high-severity vulnerability in gitroomhq postiz-app
Postiz stored XSS in public preview page
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.9epss 0.3%
Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Affected products
gitroomhq · postiz-appRelated CVEs — gitroomhq postiz-app
In the same product, most dangerous first.
CVE-2026-19264CRITICALUnauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeoverEPSS 1.0%CVE-2026-42298CRITICALPostiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.devEPSS 0.5%CVE-2026-34577HIGHPostiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension CheckEPSS 0.5%CVE-2026-40168HIGHPostiz has Server-Side Request Forgery via Redirect Bypass in /api/public/streamEPSS 0.4%CVE-2025-53641HIGHPostiz allows header mutation in middleware facilitates resulting in SSRFEPSS 0.3%CVE-2026-34576HIGHPostiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadataEPSS 0.3%