Postiz CVE-2026-42556
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as post-creating user
-
DeliveryTamper save request to store HTML payload
-
ExploitSend /p/<postId>?share=true link to victim
-
ExecutionVictim opens public preview page
-
PersistStored HTML runs via dangerouslySetInnerHTML on app origin
-
ImpactHijack session / act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) an authenticated Postiz account with permission to create posts, (2) tampering the client's own post-save request to bypass the UI and store raw HTML in post content, and (3) a victim who opens the attacker's public preview link /p/<postId>?share=true, which renders the stored HTML via dangerouslySetInnerHTML on the main application origin. Limiting factors: it is not unauthenticated (PR:L - an account is needed), it depends on victim user interaction (UI:R - the target must click the shared preview link), and it is only present in versions 2.21.6 up to 2.21.7. These conditions make it a targeted social-engineering attack rather than an unauthenticated drive-by, which is why SSVC marks it Automatable: no. |
| Impact | The signals are mixed and warrant nuance. CVSS 3.1 rates this 8.9 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) - the high score is driven mainly by the scope change (S:C) and same-origin script execution, not by ease of mass exploitation. Counterbalancing this, EPSS is only 0.04% (12th percentile) and CISA SSVC records Exploitation: none and Automatable: no, meaning no observed exploitation and no evidence of reliable automation. The attack requires an authenticated account that can create posts (PR:L) and victim interaction with the crafted preview link (UI:R), so it is a targeted, social-engineering-dependent vector rather than a wormable internet-wide threat. Net assessment: genuinely high impact if triggered (session hijack on the app origin, SSVC technical impact 'total'), but real-world likelihood is moderate-to-low and opportunistic - prioritize patching for multi-tenant or shared Postiz instances where untrusted users can register, and treat single-operator self-hosted instances as lower urgency. |
| Exploit ScenarioDerived | An attacker registers or uses an existing low-privilege Postiz account, creates a post, and intercepts the save request to store an HTML/JavaScript payload in the post content that would normally be escaped. They then send the victim the public preview link /p/<postId>?share=true; when the victim opens it, the payload executes on the main Postiz origin and can steal session tokens or perform in-app actions as the victim. No public POC is identified, but AV:N/AC:L makes crafting the tampered request straightforward for anyone with an account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user who can create a post inject arbitrary HTML into post content by tampering with their own save request, then weaponize it via the public preview link /p/<postId>?share=true. Because the preview page renders the stored markup with dangerouslySetInnerHTML on the main application origin, a shared link executes attacker JavaScript in a victim's authenticated session context. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total; the issue is fixed in 2.21.7.
RemediationAI
Vendor-released patch: upgrade to Postiz 2.21.7, which the vendor flags as an immediate-upgrade security release (https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 and advisory GHSA-hhxq-3wg7-4rj8). If you cannot upgrade immediately, apply compensating controls: restrict or disable the public preview feature (the /p/<postId>?share=true share route) so stored content cannot be rendered to other users - trade-off is loss of shareable previews; front the app with a WAF or reverse-proxy rule that strips/escapes HTML in post-save requests and blocks script-bearing preview responses - trade-off is possible false positives on legitimate rich content; and tighten account provisioning so only trusted users can create posts, since exploitation requires an authenticated post-creating account. Adding a strict Content-Security-Policy (disallowing inline script on the app origin) reduces impact of any injected markup, though it may break existing inline UI behavior and is a defense-in-depth measure, not a full fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Postiz is a self-hostable AI-driven social-media scheduling platform (Node/React). The flaw is a classic CWE-79 stored XSS: user-controlled post content is persisted without sanitization and later injected into the DOM through React's dangerouslySetInnerHTML, which deliberately bypasses React's default HTML escaping. The critical amplifier is that the vulnerable render occurs on the /p/<postId> public preview route served from the main application origin rather than a sandboxed domain, so injected script runs with the same-origin privileges of the Postiz app (cookies, localStorage tokens, in-app API access). The affected package is identified in CPE as cpe:2.3:a:gitroomhq:postiz-app.
Know when Postiz App gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Authenticated user can inject (PR:L) but needs victim to open the shared link (UI:R); same-origin script execution changes scope (S:C) yielding high C/I, with no real availability impact (A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7.
Executive ViewAI
Postiz 2.21.6 allows any authenticated user to inject malicious code into posts that executes in other users' authenticated sessions when preview links are shared, enabling potential account compromise or unauthorized manipulation of social media campaigns. Though no active exploitation has been observed, the vulnerability poses a significant session-level risk to all users in organizations operating this version. Immediate upgrade to Postiz 2.21.7 is required.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)NVD
More in Postiz App
View allFile upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to up
Postiz (gitroomhq/postiz-app) before v2.25.1 allows any signed-in user to invoke arbitrary internal integration methods
Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated us
Improper token-purpose validation in Postiz (gitroomhq/postiz-app) through v2.25.2 allows any authenticated user holding
Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 throug
Postiz instances older than v2.25.3 that store media on local disk let a registered user have the publishing worker read
Arbitrary file read in Postiz (gitroomhq/postiz-app before 2.22.1) lets an unauthenticated remote attacker retrieve any
Predictable, non-cryptographic credential generation in Postiz (gitroomhq/postiz-app, all versions prior to v2.24.0) all
Server-side request forgery in Postiz AI social media scheduling tool (versions < 2.21.3) allows unauthenticated remote
Server-side request forgery (SSRF) in Postiz social media scheduling tool versions prior to 2.21.3 allows authenticated
Server-side request forgery in Postiz (gitroomhq postiz-app) versions prior to 2.21.5 allows unauthenticated remote atta
Business-logic authentication bypass in Postiz self-hosted AI social media scheduler (gitroomhq/postiz-app) before 2.21.
Exploit-DB