Vulnerability details
CVE-2026-34577
gitroomhq postiz-app
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
CVSS 3.1
8.6High
Official description
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources. This issue has been patched in version 2.21.3.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| gitroomhq | postiz-app | < 2.21.3 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-mv6h-v3jg-g539 x_refsource_CONFIRM
- https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-02
- Last updated
- 2026-04-03
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.48%
Probability of exploitation in 30 days
41.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-918Server-Side Request Forgery (SSRF)