EUVD-2026-23634Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Lifecycle Timeline
8DescriptionGitHub Advisory
Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the Content-Type header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (text/html, image/svg+xml), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.
Articles & Coverage 1
AnalysisAI
File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to upload executable file types (HTML, SVG) with spoofed Content-Type headers, achieving stored XSS when nginx serves files using their original extensions. Attackers can hijack sessions and take over other user accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated access to Postiz application with file upload privileges (PR:L indicates low-privilege user account sufficient). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is HIGH despite requiring authenticated access (PR:L) and user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with basic user privileges creates an account on the Postiz platform and navigates to a file upload feature (profile picture, media attachment, etc.). They craft a malicious HTML file containing JavaScript session hijacking code or an SVG image with embedded XSS payload. … |
| Remediation | Upgrade immediately to Postiz version 2.21.6 or later, released by the vendor to address this vulnerability (https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Postiz deployments and confirm current version numbers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Authentication bypass in vLLM versions 0.3.0 through 0.21.x allows remote unauthenticated attackers to reach OpenAI-comp
Configuration injection in NGINX Gateway Fabric (when paired with NGINX Plus as the data plane) allows an authenticated
Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects the ngx_http_proxy_v2_module and ngx_http_grpc_mo
Use-after-free in NGINX Open Source's ngx_http_v3_module allows remote unauthenticated attackers to crash worker process
Cross-tenant container deletion in the Radius Kubernetes controller (versions <= v0.57.1) allows a tenant with Deploymen
Share
External POC / Exploit Code
Leaving vuln.today