CVE-2026-40487
Stored XSS via File Upload Validation Bypass in Postiz
Publication date: 2026-04-18
Last updated on: 2026-04-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitroom | postiz | to 2.21.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Postiz, an AI social media scheduling tool, prior to version 2.21.6. It allows any authenticated user to bypass file upload validation by spoofing the Content-Type header. As a result, the user can upload arbitrary HTML, SVG, or other executable file types to the server.
The uploaded files are served by nginx with a Content-Type based on their original file extension, such as text/html or image/svg+xml. This behavior enables Stored Cross-Site Scripting (XSS) attacks within the context of the application's origin.
How can this vulnerability impact me? :
The vulnerability can lead to serious security impacts including session riding, account takeover, and full compromise of other users' accounts. Because the malicious files are served as executable content, attackers can execute scripts in the context of the application, potentially stealing sensitive information or performing unauthorized actions.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Postiz to version 2.21.6 or later, where the file upload validation bypass has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users to upload arbitrary executable files, leading to Stored Cross-Site Scripting (XSS) attacks that can result in session riding, account takeover, and full compromise of other users' accounts.
Such security issues can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of user data and secure handling of personal information to prevent unauthorized access and data breaches.
However, the provided information does not explicitly describe the direct effects on compliance with these regulations.