Published advisories
17 advisories published under Postiz.
PSA-2026-G1CT26GCVE-125-2026-G1CT26August 15, 2026Postiz CloudDMARC not enabled for postiz.com
Postiz has not enabled DMARC on their primary domain, resulting to email forgery.
MediumPSA-2026-TH12B7CVE-2026-19264August 7, 2026Postiz AppUnauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeover
CriticalPSA-2026-NWZN9JCVE-2026-19127June 22, 2026Postiz AppInsufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
MediumPSA-2026-Q3TCPKCVE-2026-48799May 23, 2026Postiz AppUnauthenticated arbitrary lifetime PRO grant via Nowpayments webhook
MediumPSA-2026-WWFR8XCVE-2026-48783May 22, 2026Postiz AppUnauthenticated billing-enforcement bypass via /public/modify-subscription
MediumPSA-2026-2CAQ96CVE-2026-48781May 22, 2026Postiz AppSUPERADMIN takeover via Skool-provider JWT forgery
Attackers can exploit the skool-provider JWT sign process to generate a JWT token with isSuperAdmin: true
HighPSA-2026-04-M1S0CVE-2026-42346April 28, 2026Postiz AppTOCTOU DNS rebinding bypasses all SSRF URL validation paths
TOCTOU DNS rebinding bypasses all SSRF URL validation paths
MediumPSA-2026-T0E4W0CVE-2026-42556April 27, 2026Postiz AppPostiz stored XSS in public preview page
Postiz stored XSS in public preview page
HighPSA-2026-04-1YDYCVE-2026-42298April 24, 2026Postiz AppArbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
CriticalPSA-2026-04-6EZ5CVE-2026-40168April 22, 2026Postiz AppServer-Side Request Forgery via Redirect Bypass in /api/public/stream
Server-Side Request Forgery via Redirect Bypass in /api/public/stream
HighPSA-2026-04-5MVGCVE-2026-40487April 19, 2026Postiz AppUnrestricted File Upload via MIME Type Spoofing Leads to Stored XSS
Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS
CriticalPSA-2026-04-HVBMCVE-2026-34590April 19, 2026Postiz AppSSRF via Webhook Creation Endpoint Missing URL Safety Validation
SSRF via Webhook Creation Endpoint Missing URL Safety Validation
MediumPSA-2026-04-KT4WCVE-2026-34576April 19, 2026Postiz AppSSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
MediumPSA-2026-04-422GCVE-2026-34577April 19, 2026Postiz AppUnauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
HighPSA-2026-04-SRGACVE-2024-34351April 19, 2026Postiz AppHigh-Severity SSRF in Postiz App
High-Severity SSRF in Postiz App
HighPSA-2026-04-ZR1MGHSA-89v5-38xr-9m4jApril 19, 2026Postiz AppMultiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)
Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader (CWE-918)
HighPSA-2026-04-PY6VCVE-2025-53641April 19, 2026Postiz AppHeader mutation in middleware facilitates SSRF
Header mutation in middleware facilitates SSRF
High