Postiz App CVE-2026-40487

Requires authenticated access to Postiz application with file upload privileges (PR:L indicates low-privilege user account sufficient). Exploitation requires user interaction (UI:R) - a victim must view or access the uploaded malicious file through their browser. The application must be configured with nginx serving uploaded files directly from storage with MIME type determined by file extension rather than validated content type. No special deployment configuration or non-default settings are required beyond standard Postiz installation, making all default deployments of affected versions vulnerable. Attack is network-based (AV:N) requiring no local system access. Limiting factors include: attacker must successfully social engineer victims to access the uploaded malicious content, and some browsers' XSS auditors may block certain payload types (though modern browsers have largely deprecated built-in XSS filters).

Real-world risk is HIGH despite requiring authenticated access (PR:L) and user interaction (UI:R). The low attack complexity (AC:L) means exploitation requires only basic authenticated access to the file upload feature and social engineering to make victims view the uploaded content. The changed scope (S:C) elevates severity significantly - attackers compromise not just their own session but other users' accounts through stored XSS. High confidentiality and integrity impact (C:H/I:H) reflects full session hijacking and account takeover capabilities. While no EPSS score is provided and the CVE is not in CISA KEV, the availability of a public GitHub Security Advisory (GHSA-44wg-r34q-hvfx) means attack details are documented and reproducible. For multi-tenant SaaS deployments of Postiz, this represents critical risk as one malicious authenticated user can compromise all other tenant accounts. The targeted nature (authenticated attacker, social media scheduling context) suggests lower widespread exploitation probability but HIGH impact for organizations using affected versions.

An authenticated attacker with basic user privileges creates an account on the Postiz platform and navigates to a file upload feature (profile picture, media attachment, etc.). They craft a malicious HTML file containing JavaScript session hijacking code or an SVG image with embedded XSS payload. During upload, the attacker intercepts the request and modifies the Content-Type header to image/png or image/jpeg to bypass client-side and weak server-side validation. The server stores the file with its original .html or .svg extension. The attacker then shares a link to the uploaded file with other users via social engineering (phishing email, chat message, or embedding in platform content). When victims click the link, nginx serves the file as text/html or image/svg+xml based on extension, executing the attacker's JavaScript in the victims' browser sessions, stealing session cookies or performing actions as the victim.