CVE-2026-40487 - Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

Back Back to CVE browser

CRITICAL

Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

Published Apr 18, 2026

9.0

CRITICAL

CVSS 3.1

EPSS 0.26%

Description

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

Affected products

Vendor Gitroomhq Product Postiz-App Default
n/a
- Version
  < 2.21.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Gitroomhq

Postiz-App

n/a

Version	Status	Constraints
< 2.21.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-345

CWE-434

Unrestricted Upload of File

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23634
Advisory
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6
x_refsource_MISCProductRelease Notes
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfx
exploitx_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23634		Advisory
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6		x_refsource_MISCProductRelease Notes
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfx		exploitx_refsource_CONFIRMVendor Advisory