CVE-2026-34576: Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
Vulnerability summary
CVE-2026-34576 is a high (CVSS 8.3) Server-Side Request Forgery (SSRF) vulnerability in gitroom postiz. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-04-2026PublishedVulnerability first disclosed.
- 02-04-2026Last modifiedVulnerability information updated.
Description
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension check (.png, .jpg, etc.) which is trivially bypassed by appending an image extension to any URL path. An authenticated API user can fetch internal network resources, cloud instance metadata, and other internal services, with the response data uploaded to storage and returned to the attacker. This issue has been patched in version 2.21.3.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.3HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.37%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
Increase +0.10 pp
From 0.27% on 23-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPostiz App
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Gitroom1 product
- postiz< 2.21.3
Gitroomhq1 product
- postiz-app< 2.21.3
2 vendors · 2 products
References
2 links- github.com/gitroomhq/postiz-app/security/advisories/GHSA-89vp-m2qw-7v34X Refsource CONFIRMExploitMitigationVendor Advisory