← Vulnerability feed

Vulnerability record · CVE-2026-40487 · published 18 April 2026

CVE-2026-40487: Gitroom postiz cross-site scripting vulnerability

Gitroom · Postiz

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

9.0 CVSS 3.1 Critical EPSS 0.26% · top 84.6% CWE-79 · Cross-site scriptingCWE-345 · Insufficient verification of data authenticity
9.0CVSS 3.1 base score
0.26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6 ProductRelease Notes
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfx ExploitVendor Advisory
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfx ExploitVendor Advisory

Track CVE-2026-40487 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-42298Gitroom postiz code injection vulnerabilityPostiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflo…EPSS 0.81%9.0CVE-2026-42556Gitroom postiz cross-site scripting vulnerabilityPostiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store ar…EPSS 0.44%8.6CVE-2026-34577Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied ur…EPSS 0.53%8.3CVE-2026-34576Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and f…EPSS 0.37%8.2CVE-2026-40168Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application valida…EPSS 0.52%5.4CVE-2026-34590Gitroom postiz server-side request forgery (ssrf) vulnerabilityPostiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which vali…EPSS 0.33%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed

Source: NIST National Vulnerability Database (record CVE-2026-40487), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.