Postiz Security Advisories
All advisories
PSA-2026-04-5MVGCVE-2026-40487GCVE-125-2026-04-5MVGApril 19, 2026Assigned April 14, 2026
9.0 Critical

Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS

Unrestricted File Upload via MIME Type Spoofing Leads to Stored XSS

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 0Fixed in 2.21.6Affected

    All other versions: Unaffected

Mitigations

Workarounds

  • No reliable workaround exists prior to v2.21.6. As partial mitigation, administrators can disable file uploads or serve /uploads/ with Content-Disposition: attachment and a restrictive Content-Security-Policy in nginx to prevent inline rendering of uploaded files.

Solutions

  • Upgrade to v2.21.6 or later.

Exploits

  • Stored Cross-Site Scripting (XSS) that allows any authenticated user to persistently compromise other users by uploading malicious files.
  • The application signs JWTs with no exp claim, meaning tokens never expire. Uploaded files also persist indefinitely and require no authentication to access, so any user can be targeted at any time.

Overview

A file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the Content-Type header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (text/html, image/svg+xml), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts.

Severity

CVSS v3
9.0 Critical
9.0
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Weaknesses (3)

References (2)

Credits (3)

  • Lorenzo Anastasi
    Reporter · @Astaruf
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • Through clicking the upload link, the attacker can invite himself as an admin to the team, gaining full admin permissions.

  • Fully removing all posts & integrations of the team.

  • Gaining full API access, while impersonating the victim.

Timeline

  1. 04/10/2026 11:37

    Postiz has received the advisory.

  2. 04/10/2026 16:04

    Postiz has acknowledged the advisory.

  3. 04/11/2026 23:23

    Postiz has verified the advisory.

  4. 04/12/2026 04:07

    Postiz has developed a fix, verified it, created the release and published the advisory.

  5. 04/14/2026 13:50

    GitHub has issued CVE-2026-40487 for this advisory.