What’s Vulnerable › Vulnerabilities

CVE-2026-34577: Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-02 · updated 2026-07-24
• Weakness: CWE-918

Description

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources. This issue has been patched in version 2.21.3.

Affected products

• gitroomhq postiz-app: before 2.21.3 — fixed in 2.21.3

How to fix

Upgrade to a fixed version: gitroomhq postiz-app 2.21.3. Check the vendor advisory for mitigations.

References

• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-mv6h-v3jg-g539

Get alerted when CVE-2026-34577 or the next vulnerability affects your stack