CVE-2026-34577 - Vulnerability Analysis

Overview

Postiz < 2.21.3 contains a server side request forgery caused by insufficient validation of the url parameter in GET /public/stream, letting unauthenticated attackers read internal network resources, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can read internal network and cloud metadata responses, potentially exposing sensitive internal information.

Mitigation

Update to version 2.21.3 or later.

References

• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-mv6h-v3jg-g539

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner