Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M

CVE-2026-34577Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

High 8.6

In plain English

A high-severity server-side request forgery in postiz-app from gitroomhq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 58.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources. This issue has been patched in version 2.21.3.

Affected products (as reported)

Vendor	Product	Versions
gitroomhq	postiz-app	< 2.21.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-mv6h-v3jg-g539 x_refsource_CONFIRM
https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3 x_refsource_MISC