CVE-2026-34577: Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

Vulnerability summary

CVE-2026-34577 is a high (CVSS 8.6) Server-Side Request Forgery (SSRF) vulnerability in gitroom postiz. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-04-2026
   PublishedVulnerability first disclosed.
2. 03-04-2026
   Last modifiedVulnerability information updated.

Description

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources. This issue has been patched in version 2.21.3.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.