CVE-2026-40487Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
Updated under an hour ago ()
Does this affect you?
It affects gitroomhq postiz-app and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.
- CVSS
- 8.9 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
- Weakness (CWE)
- CWE-79, CWE-345, CWE-434
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Apr 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
gitroomhq postiz-app gitroomhq:postiz_app (from the name) | before 2.21.6 | CNA record |
gitroom postiz gitroom:postiz | before 2.21.6 | NVD |
References
- https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfxx-refsource-confirm, exploit, vendor-advisory
- https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6x-refsource-misc, product, release-notes
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.