Vulnerability · Published Jul 11, 2025 · Assigned by GitHub_M

CVE-2025-53641Postiz allows header mutation in middleware facilitates resulting in SSRF

High 8.2

In plain English

A high-severity server-side request forgery in postiz-app from gitroomhq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to initiate unauthorized outbound requests from the server hosting the Postiz application. This vulnerability is fixed in 1.62.3.

Affected products (as reported)

Vendor	Product	Versions
gitroomhq	postiz-app	>= 1.45.1, < 1.62.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-48c8-25jq-m55f x_refsource_CONFIRM
https://github.com/gitroomhq/postiz-app/commit/65eca0e2f22155b43c78724ca43617ee52e42753 x_refsource_MISC