What is the CVSS score of CVE-2026-40487?

CVE-2026-40487 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Postiz App are affected by CVE-2026-40487?

Postiz social media scheduler versions before 2.21.6 contain a file upload validation bypass that allows authenticated users to upload malicious files disguised as benign content types, leading to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-40487?

Yes, a public proof-of-concept exploit is available for CVE-2026-40487. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-40487?

Within 24 hours: Identify all Postiz deployments and confirm current version numbers. Within 7 days: Upgrade all Postiz instances to version 2.21.6 or later per vendor patch release. Verify patch deployment across all affected systems. Within 30 days: Conduct audit of file upload logs since deployment to identify any suspicious uploads with mismatched Content-Type headers; reset session tokens for all users as a precautionary measure.

Postiz App CVE-2026-40487

EUVD-2026-23634 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-18 GitHub_M

XSS Nginx File Upload Postiz App Gitroomhq

8.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Apr 23, 2026 - 15:27 nvd

Patch available

Analysis Updated

Apr 18, 2026 - 02:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 18, 2026 - 02:22 vuln.today

cvss_changed

Patch available

Apr 18, 2026 - 02:01 EUVD

Analysis Generated

Apr 18, 2026 - 01:53 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 01:45 euvd

EUVD-2026-23634

Analysis Generated

Apr 18, 2026 - 01:45 vuln.today

CVE Published

Apr 18, 2026 - 01:19 nvd

HIGH 8.9

DescriptionGitHub Advisory

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the Content-Type header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (text/html, image/svg+xml), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

Articles & Coverage 1

POC CVE-2026-42208: Critical Pre-Auth SQL Injection in LiteLLM AI Gateway May 04, 2026

AnalysisAI

File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to upload executable file types (HTML, SVG) with spoofed Content-Type headers, achieving stored XSS when nginx serves files using their original extensions. Attackers can hijack sessions and take over other user accounts. CVSS 8.9 (High) reflects network attack vector with low complexity requiring only low-privilege authentication and user interaction. EPSS data not provided. Not listed in CISA KEV. Vendor patch released in version 2.21.6.

Technical ContextAI

Postiz (gitroomhq/postiz-app) is an AI-powered social media scheduling platform. The vulnerability stems from insufficient server-side validation of uploaded files (CWE-79: Improper Neutralization of Input During Web Page Generation). The application validates files based solely on the HTTP Content-Type header sent by the client, which can be arbitrarily spoofed. When malicious files (HTML, SVG with embedded JavaScript) are uploaded, the nginx web server determines MIME type from file extension rather than the spoofed upload header, serving them as text/html or image/svg+xml. This creates a stored XSS condition where the malicious content executes in victims' browsers within the application's security origin, bypassing same-origin policy protections. The scope change (S:C) in the CVSS vector indicates the vulnerability impacts resources beyond the vulnerable component itself, consistent with cross-user account compromise scenarios.

RemediationAI

Upgrade immediately to Postiz version 2.21.6 or later, released by the vendor to address this vulnerability (https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6). The patch implements proper server-side file type validation independent of client-supplied Content-Type headers. If immediate upgrade is not feasible, implement these compensating controls: (1) Configure nginx to serve all user-uploaded content from a separate domain/subdomain with restrictive Content-Security-Policy headers to prevent script execution - this breaks same-origin XSS but requires application architecture changes and may affect legitimate file sharing features; (2) Implement allowlist-based file extension validation rejecting .html, .svg, .xml, and other executable types at the application layer before storage - this reduces attack surface but sophisticated attackers may find bypass techniques; (3) Set X-Content-Type-Options: nosniff header and force all uploads to download with Content-Disposition: attachment - this prevents browser rendering but degrades user experience for legitimate media previews. Review application logs for suspicious file uploads (especially HTML/SVG files) uploaded since deployment to identify potential compromise.