Postiz App
Monthly
Arbitrary file read in Postiz (gitroomhq/postiz-app before 2.22.1) lets an unauthenticated remote attacker retrieve any file readable by the application process via the /api/uploads media route, which fails to confine URL-supplied path segments to the upload directory. Because URL-encoded traversal sequences survive Next.js route matching and are decoded only at the filesystem call, an attacker can read the process environment to steal the JWT signing secret, then forge a non-expiring administrator session without a password - turning a file-disclosure bug into full account takeover. There is publicly available fix code (vendor commit and v2.22.1 release), but no public exploit identified at time of analysis and the issue is not in CISA KEV.
Business-logic authentication bypass in Postiz self-hosted AI social media scheduler (gitroomhq/postiz-app) before 2.21.8 lets a low-privileged authenticated user grant any organization a lifetime PRO subscription without paying. The Nowpayments IPN (Instant Payment Notification) callback handler never validated the provider's shared-secret signature and trusted the subscription/organization identifier straight from the request body, so an attacker could forge a payment-confirmation callback. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was privately reported and fixed by removing the crypto-payment code path entirely.
Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated user to forge session JWTs and impersonate arbitrary organizations. The Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware blindly trusted every claim without re-resolving the user from the database. No public exploit identified at time of analysis, but the fix commit is public and the root cause is trivially reproducible from the patch diff.
Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user who can create a post inject arbitrary HTML into post content by tampering with their own save request, then weaponize it via the public preview link /p/<postId>?share=true. Because the preview page renders the stored markup with dangerouslySetInnerHTML on the main application origin, a shared link executes attacker JavaScript in a victim's authenticated session context. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total; the issue is fixed in 2.21.7.
Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 through an insecure GitHub Actions 'Pwn Request' pattern in the Build and Publish PR Docker Image workflow. Because the workflow triggers on pull_request_target with 'permissions: write-all' yet checks out and builds the untrusted fork head (Dockerfile.dev), any unauthenticated GitHub user can open a fork PR with a malicious Dockerfile.dev to run code on the runner and exfiltrate a write-all GITHUB_TOKEN, effectively hijacking the repository's CI/CD supply chain. Rated CVSS 10.0 with SSVC technical impact 'total' and automatable 'yes', but EPSS is low (0.14%) with no public exploit or KEV listing at time of analysis.
File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to upload executable file types (HTML, SVG) with spoofed Content-Type headers, achieving stored XSS when nginx serves files using their original extensions. Attackers can hijack sessions and take over other user accounts. CVSS 8.9 (High) reflects network attack vector with low complexity requiring only low-privilege authentication and user interaction. EPSS data not provided. Not listed in CISA KEV. Vendor patch released in version 2.21.6.
Server-side request forgery in Postiz (gitroomhq postiz-app) versions prior to 2.21.5 allows unauthenticated remote attackers to access internal network resources and exfiltrate sensitive data via the /api/public/stream endpoint. The vulnerability exploits inadequate redirect validation: attackers supply public HTTPS URLs that pass initial validation but redirect server requests to private internal hosts, bypassing security controls. High confidentiality impact with potential service disruption. No public exploit identified at time of analysis.
Server-side request forgery in Postiz AI social media scheduling tool (versions < 2.21.3) allows unauthenticated remote attackers to read internal network resources and cloud metadata endpoints through the /public/stream proxy endpoint. The vulnerability bypasses trivial .mp4 validation via query parameters or URL fragments, enabling unauthorized access to internal services without authentication. No public exploit identified at time of analysis, but CVSS 8.6 reflects high confidentiality impact with network-level attack vector and low complexity. EPSS data not available, but the combination of no authentication requirement and cloud metadata access risk makes this a priority for organizations running Postiz in cloud environments.
Server-side request forgery (SSRF) in Postiz social media scheduling tool versions prior to 2.21.3 allows authenticated API users to fetch arbitrary URLs by exploiting the POST /public/v1/upload-from-url endpoint, which performs server-side URL fetching via axios without SSRF protections and relies solely on a bypassable file extension check. Attackers can retrieve internal network resources, cloud metadata, and internal service data, with responses captured and returned to the attacker. Vendor-released patch available in version 2.21.3.
Unauthenticated exploitation of Postiz's `/public/modify-subscription` endpoint allowed any caller in possession of a validly signed NowPayments callback token to trigger subscription enforcement side effects against their own organization - disabling team members, dropping integrations, and resetting the scheduled-post cron - without Postiz authentication. The flaw (CWE-345) stems from the NowPayments crypto payment integration: the endpoint verified the token's cryptographic signature but never validated its intended purpose or bound it to a specific subscription-modification context. Impact is strictly self-contained; the endpoint cannot be redirected at other tenants. No public exploit code and no CISA KEV listing have been identified at time of analysis. The issue is fixed in Postiz 2.21.8.
DNS rebinding exploits a TOCTOU flaw in Postiz v2.16.6-2.21.6 to bypass all SSRF protections added in v2.21.4-v2.21.6, allowing unauthenticated remote attackers to reach internal network services and cloud metadata endpoints. The root defect is architectural: `isSafePublicHttpsUrl()` validates an IP via one DNS resolution, but the subsequent `fetch()` call performs its own independent DNS resolution - an attacker controlling a DNS server can return a legitimate public IP on the first query and swap to an internal address (e.g., 169.254.169.254) on the second. No public exploit has been identified and exploitation is not confirmed by CISA KEV, but the high confidentiality impact reflects realistic cloud-credential theft via IMDSv1-style metadata services.
Server-side request forgery (SSRF) in Postiz prior to version 2.21.4 allows authenticated users to create webhooks pointing to internal or private network addresses, which are then fetched without runtime validation when posts are published, enabling blind SSRF attacks against internal services. The vulnerability stems from inconsistent input validation: the webhook creation endpoint (POST /webhooks/) uses only basic URL format checking, while the update and test endpoints correctly enforce strict URL validation. CVSS 5.4 with EPSS exploitation probability reflects the requirement for authentication and limited direct impact, though the ability to target internal infrastructure represents meaningful risk.
Arbitrary file read in Postiz (gitroomhq/postiz-app before 2.22.1) lets an unauthenticated remote attacker retrieve any file readable by the application process via the /api/uploads media route, which fails to confine URL-supplied path segments to the upload directory. Because URL-encoded traversal sequences survive Next.js route matching and are decoded only at the filesystem call, an attacker can read the process environment to steal the JWT signing secret, then forge a non-expiring administrator session without a password - turning a file-disclosure bug into full account takeover. There is publicly available fix code (vendor commit and v2.22.1 release), but no public exploit identified at time of analysis and the issue is not in CISA KEV.
Business-logic authentication bypass in Postiz self-hosted AI social media scheduler (gitroomhq/postiz-app) before 2.21.8 lets a low-privileged authenticated user grant any organization a lifetime PRO subscription without paying. The Nowpayments IPN (Instant Payment Notification) callback handler never validated the provider's shared-secret signature and trusted the subscription/organization identifier straight from the request body, so an attacker could forge a payment-confirmation callback. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was privately reported and fixed by removing the crypto-payment code path entirely.
Privilege escalation to SUPERADMIN in Postiz (gitroomhq/postiz-app) versions prior to 2.21.8 allows any authenticated user to forge session JWTs and impersonate arbitrary organizations. The Skool integration callback signed an attacker-controlled JSON blob into a session-shape JWT using the application's JWT_SECRET, and the auth middleware blindly trusted every claim without re-resolving the user from the database. No public exploit identified at time of analysis, but the fix commit is public and the root cause is trivially reproducible from the patch diff.
Stored cross-site scripting in Postiz (gitroomhq/postiz-app) versions 2.21.6 through 2.21.6 lets any authenticated user who can create a post inject arbitrary HTML into post content by tampering with their own save request, then weaponize it via the public preview link /p/<postId>?share=true. Because the preview page renders the stored markup with dangerouslySetInnerHTML on the main application origin, a shared link executes attacker JavaScript in a victim's authenticated session context. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total; the issue is fixed in 2.21.7.
Arbitrary code execution and privileged token theft affects Postiz (gitroomhq/postiz-app) prior to commit da44801 through an insecure GitHub Actions 'Pwn Request' pattern in the Build and Publish PR Docker Image workflow. Because the workflow triggers on pull_request_target with 'permissions: write-all' yet checks out and builds the untrusted fork head (Dockerfile.dev), any unauthenticated GitHub user can open a fork PR with a malicious Dockerfile.dev to run code on the runner and exfiltrate a write-all GITHUB_TOKEN, effectively hijacking the repository's CI/CD supply chain. Rated CVSS 10.0 with SSVC technical impact 'total' and automatable 'yes', but EPSS is low (0.14%) with no public exploit or KEV listing at time of analysis.
File upload validation bypass in Postiz social media scheduler (versions before 2.21.6) allows authenticated users to upload executable file types (HTML, SVG) with spoofed Content-Type headers, achieving stored XSS when nginx serves files using their original extensions. Attackers can hijack sessions and take over other user accounts. CVSS 8.9 (High) reflects network attack vector with low complexity requiring only low-privilege authentication and user interaction. EPSS data not provided. Not listed in CISA KEV. Vendor patch released in version 2.21.6.
Server-side request forgery in Postiz (gitroomhq postiz-app) versions prior to 2.21.5 allows unauthenticated remote attackers to access internal network resources and exfiltrate sensitive data via the /api/public/stream endpoint. The vulnerability exploits inadequate redirect validation: attackers supply public HTTPS URLs that pass initial validation but redirect server requests to private internal hosts, bypassing security controls. High confidentiality impact with potential service disruption. No public exploit identified at time of analysis.
Server-side request forgery in Postiz AI social media scheduling tool (versions < 2.21.3) allows unauthenticated remote attackers to read internal network resources and cloud metadata endpoints through the /public/stream proxy endpoint. The vulnerability bypasses trivial .mp4 validation via query parameters or URL fragments, enabling unauthorized access to internal services without authentication. No public exploit identified at time of analysis, but CVSS 8.6 reflects high confidentiality impact with network-level attack vector and low complexity. EPSS data not available, but the combination of no authentication requirement and cloud metadata access risk makes this a priority for organizations running Postiz in cloud environments.
Server-side request forgery (SSRF) in Postiz social media scheduling tool versions prior to 2.21.3 allows authenticated API users to fetch arbitrary URLs by exploiting the POST /public/v1/upload-from-url endpoint, which performs server-side URL fetching via axios without SSRF protections and relies solely on a bypassable file extension check. Attackers can retrieve internal network resources, cloud metadata, and internal service data, with responses captured and returned to the attacker. Vendor-released patch available in version 2.21.3.
Unauthenticated exploitation of Postiz's `/public/modify-subscription` endpoint allowed any caller in possession of a validly signed NowPayments callback token to trigger subscription enforcement side effects against their own organization - disabling team members, dropping integrations, and resetting the scheduled-post cron - without Postiz authentication. The flaw (CWE-345) stems from the NowPayments crypto payment integration: the endpoint verified the token's cryptographic signature but never validated its intended purpose or bound it to a specific subscription-modification context. Impact is strictly self-contained; the endpoint cannot be redirected at other tenants. No public exploit code and no CISA KEV listing have been identified at time of analysis. The issue is fixed in Postiz 2.21.8.
DNS rebinding exploits a TOCTOU flaw in Postiz v2.16.6-2.21.6 to bypass all SSRF protections added in v2.21.4-v2.21.6, allowing unauthenticated remote attackers to reach internal network services and cloud metadata endpoints. The root defect is architectural: `isSafePublicHttpsUrl()` validates an IP via one DNS resolution, but the subsequent `fetch()` call performs its own independent DNS resolution - an attacker controlling a DNS server can return a legitimate public IP on the first query and swap to an internal address (e.g., 169.254.169.254) on the second. No public exploit has been identified and exploitation is not confirmed by CISA KEV, but the high confidentiality impact reflects realistic cloud-credential theft via IMDSv1-style metadata services.
Server-side request forgery (SSRF) in Postiz prior to version 2.21.4 allows authenticated users to create webhooks pointing to internal or private network addresses, which are then fetched without runtime validation when posts are published, enabling blind SSRF attacks against internal services. The vulnerability stems from inconsistent input validation: the webhook creation endpoint (POST /webhooks/) uses only basic URL format checking, while the update and test endpoints correctly enforce strict URL validation. CVSS 5.4 with EPSS exploitation probability reflects the requirement for authentication and limited direct impact, though the ability to target internal infrastructure represents meaningful risk.