Skip to content
OpenAdvisories
High · 7.5 GHSA-vj2p-7pgw-g2wf

Postiz App has a High-Severity SSRF Vulnerability via Next.js

Published Mar 27, 2026 · Updated Mar 27, 2026 · Assigned by GHSA

Description

### Impact
A successful SSRF attack allows an attacker to:
- Bypass firewalls to scan and interact with internal network services/ports.
- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.
- Pivot into the internal network environment where Postiz is hosted.

### Workarounds
There are no workarounds known to this, please upgrade to Postiz version `v2.21.1`.

Affected packages

EcosystemPackageAffectedFixedRecord
npm postiz <= 2.0.12 — GHSA-vj2p-7pgw-g2wf

References