CVE-2026-40168 - Vulnerability Analysis

Overview

Postiz prior to 2.21.5 contains a server side request forgery caused by lack of re-validation of final destination URL after HTTP redirects in /api/public/stream endpoint, letting attackers access internal resources via SSRF, exploit requires ability to supply URLs that redirect.

Severity & Score

Impact

Attackers can make the server access internal resources, potentially exposing sensitive internal data or services.

Mitigation

Update to version 2.21.5 or later.

References

• https://github.com/gitroomhq/postiz-app/commit/30e8b777098157362769226d1b46d83ad616cb06
• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.5
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-34w8-5j2v-h6ww

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner