Skip to content
OpenAdvisories
High · 8.9 Public exploit CVE-2026-40487 EUVD-2026-23634

Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

Published Apr 18, 2026 · Updated Apr 20, 2026 · Assigned by GitHub_M

Vendor: gitroomhq Product: postiz-app

Description

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

Affected products

VendorProductAffectedFixed
gitroomhq postiz-app < 2.21.6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Astaruf/CVE-2026-40487 ★ 3 · Apr 15, 2026

    CVE-2026-40487 - Postiz <= 2.21.5 - Arbitrary File Upload via MIME-Type Spoofing → Stored XSS → Account Takeover

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References