Skip to content
OpenAdvisories

Package · npm

postiz

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High —
    GHSA-89v5-38xr-9m4j

    Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader

    ## Summary Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection. ## Vulnerable Code ### 1. Webhook Send Endpoint (Most Critical) **`apps/backend/src/api/routes/webhooks.controll…

    postiz npm
  • High 7.5
    GHSA-vj2p-7pgw-g2wf

    Postiz App has a High-Severity SSRF Vulnerability via Next.js

    ### Impact A successful SSRF attack allows an attacker to: - Bypass firewalls to scan and interact with internal network services/ports. - Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials. - Pi…

    postiz npm