Postiz App CVE-2026-34576

Authenticated API user with access to POST /public/v1/upload-from-url endpoint in Postiz versions prior to 2.21.3. Attacker appends image extension (.png, .jpg) to arbitrary URLs to bypass file validation and trigger server-side fetch of internal resources, metadata, or services.

This vulnerability carries significant real-world risk despite the absence of a published CVSS score. The SSRF attack vector is network-based with medium complexity (requires URL crafting and bypassing trivial extension checks), but critically, it requires prior authentication (API user context). Real-world risk is elevated by: (1) confirmed patch availability suggesting vendor validation of severity, (2) the ease of extension bypass (trivial to weaponize), (3) the high-value targets accessible via SSRF (cloud metadata, internal services, database endpoints), and (4) the presence of automated tooling for SSRF exploitation. However, the authentication requirement significantly reduces blast radius compared to unauthenticated SSRF. No KEV status or public POC was identified at time of analysis, suggesting limited active exploitation despite the straightforward nature of the attack. SSVC framework assessment: exploitation is unconfirmed publicly but highly probable given the simplicity of the bypass; impact is technical (data exfiltration from internal networks); automatable via standard HTTP clients. Organizations with internet-facing Postiz instances should prioritize patching.

An authenticated API user of a Postiz instance discovers the /public/v1/upload-from-url endpoint accepts arbitrary URLs. The attacker crafts a request to http://169.254.169.254/latest/meta-data/iam/security-credentials/?v=.jpg, bypassing the extension check by appending .jpg. The Postiz server fetches the AWS instance IAM credentials from the cloud metadata service and returns them to the attacker, who now possesses cloud credentials for lateral movement. Alternatively, the attacker targets an internal database service (e.g., http://internal-db:5432/?v=.png) or administrative endpoint, exfiltrating configuration or data. No public exploit code has been identified, but exploitation requires only standard HTTP tooling and knowledge of internal network topology.