Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

postiz-app — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in postiz-app, with AI-generated Chinese analysis, references, and POCs.

Vendor: gitroomhq

CVE IDTitleCVSSSeverityPublished
CVE-2026-42556 Postiz stored XSS in public preview page CWE-79 8.9 High2026-05-08
CVE-2026-42346 Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths CWE-918 6.5 Medium2026-05-08
CVE-2026-42298 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev CWE-94 10.0 Critical2026-05-08
CVE-2026-40487 Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CWE-79 8.9 High2026-04-18
CVE-2026-40168 Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CWE-918 8.2 High2026-04-10
CVE-2026-34590 Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CWE-918 5.4 Medium2026-04-02
CVE-2026-34577 Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CWE-918 8.6 High2026-04-02
CVE-2026-34576 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CWE-918 6.5AIMediumAI2026-04-02
CVE-2025-53641 Postiz allows header mutation in middleware facilitates resulting in SSRF CWE-918 8.2 High2025-07-11

All 9 known CVE vulnerabilities affecting postiz-app with full Chinese analysis, references, and POCs where available.