Postiz App CVE-2026-34590

CVSS score of 5.4 (Medium) reflects AV:N/AC:L/PR:L/UI:N characteristics: unauthenticated access is blocked (PR:L requires login), attack complexity is low, and direct confidentiality/integrity impact is modest (C:L/I:L/A:N). However, the risk assessment must account for deployment context: in environments where internal services are exposed on non-standard ports or where the attacker has legitimate application access, blind SSRF can enable reconnaissance of internal infrastructure, exfiltration via error messages, or interaction with internal APIs without authentication. The inconsistent validation pattern (correct logic exists in update/test endpoints but not creation) suggests this was a development oversight rather than a deliberate design choice, increasing confidence in the fix. No EPSS data or active KEV status provided; patch availability (version 2.21.4) significantly reduces real-world risk for maintained deployments. Organizations running older versions with internal services accessible from the application host warrant immediate patching.

An authenticated user with permission to create webhooks crafts a webhook URL targeting an internal service, such as http://127.0.0.1:6379/malicious-command for a Redis instance or http://internal-api.local/admin. The POST /webhooks/ endpoint accepts this URL due to missing @IsSafeWebhookUrl validation. When the attacker publishes a post, the orchestrator fetches the webhook URL and makes an HTTP request to the internal address, potentially reading error responses that leak internal configuration, interacting with unauthenticated internal APIs, or probing for open services. No public exploit code identified at time of analysis; exploitation requires knowledge of internal network topology and valid application credentials.