CVE Feed

    Dashboard / CVE / CVE-2026-40487

    CVE-2026-40487

    Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

    Published:Apr 18, 2026
    Last Modified:Apr 23, 2026
    EPS:Apr 18, 2026
    EPSS Score:0.00019
    CVSS Score:8.9

    Affected Products

    Vendor
    Gitroom
    Product
    Postiz
    Vendor
    Gitroomhq
    Product
    Postiz-app

    Exploits

    https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfxhttps://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfxhttps://github.com/Astaruf/CVE-2026-40487

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
    CAPEC-111 JSON Hijacking (aka JavaScript Hijacking)
    CAPEC-141 Cache Poisoning
    CAPEC-142 DNS Cache Poisoning
    CAPEC-148 Content Spoofing
    CAPEC-209 XSS Using MIME Type Mismatch
    CAPEC-218 Spoofing of UDDI/ebXML Messages
    CAPEC-384 Application API Message Manipulation via Man-in-the-Middle
    CAPEC-385 Transaction or Event Tampering via Application API Manipulation
    CAPEC-386 Application API Navigation Remapping
    CAPEC-387 Navigation Remapping To Propagate Malicious Content
    CAPEC-388 Application API Button Hijacking
    CAPEC-588 DOM-Based XSS
    CAPEC-591 Reflected XSS
    CAPEC-592 Stored XSS
    CAPEC-63 Cross-Site Scripting (XSS)
    CAPEC-665 Exploitation of Thunderbolt Protection Flaws
    CAPEC-701 Browser in the Middle (BiTM)
    CAPEC-85 AJAX Footprinting

    Related CVEs

    CVE-2026-42556 (CVSS 8.9) — Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated …
    CVE-2026-42298 (CVSS 10) — Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Bu…
    CVE-2026-40168 (CVSS 8.2) — Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable t…
    CVE-2026-34590 (CVSS 5.4) — Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creati…
    CVE-2026-34577 (CVSS 8.6) — Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in Publ…
    CVE-2026-34576 (CVSS 8.3) — Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url end…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High