High severity · published Apr 2, 2026
CVE-2026-34576
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension check (.png, .jpg, etc.) which is trivially bypassed by appending an image extension to any URL path. An authenticated API user can fetch internal network resources, cloud instance metadata, and other internal services, with the response data uploaded to storage and returned to the attacker. This issue has been patched in version 2.21.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
postiz-app · gitroomhq
< 2.21.3 · source: vendor
PO
Postiz · Gitroom
before 2.21.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34576
Product
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3
Exploit
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-89vp-m2qw-7v34
More from postiz-app
9.9
CVE-2026-115933
Forged signed tokens let any registered user take over other users and organizations
9.9
CVE-2026-115931
Arbitrary file read and backend crash through unrestricted provider method calls
9.9
CVE-2026-48781
Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery
9.8
CVE-2026-19264
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
9.8
CVE-2026-42298
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev