Postiz Security Advisories
All advisories
PSA-2026-04-KT4WCVE-2026-34576GCVE-125-2026-04-KT4WApril 19, 2026
4.8 Medium

SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 0Fixed in 2.21.3Affected

    All other versions: Unaffected

Mitigations

Solutions

  • Upgrade to v2.21.3 or later.

Exploits

  • Access to internal network ressources.

Overview

The POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension check (.png, .jpg, etc.) which is trivially bypassed by appending an image extension to any URL path. An authenticated API user can fetch internal network resources, cloud instance metadata, and other internal services, with the response data uploaded to storage and returned to the attacker.

Severity

CVSS v4
4.8 Medium
4.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vuln Confidentiality
High
Vuln Integrity
None
Vuln Availability
None
Sub Confidentiality
High
Sub Integrity
None
Sub Availability
None

Weaknesses (1)

References (2)

Credits (3)

  • offset
    Reporter · @offset
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • Impacts could include: - Steal cloud credentials: Access AWS/GCP/Azure instance metadata endpoints to obtain IAM role credentials, potentially leading to full cloud infrastructure compromise. - Scan internal networks: Enumerate internal services, ports, and hosts that are not directly accessible from the internet. - Access internal services: Read data from internal databases, admin panels, caches (Redis), and other services on the internal network. - Exfiltrate data: All fetched responses are uploaded to cloud storage and a download URL is returned, providing a full data exfiltration channel.

Timeline

  1. 03/28/2026 13:05

    Postiz has received the advisory.

  2. 03/28/2026 17:04

    Postiz acknowledged and verified the advisory.

  3. 03/29/2026 07:15

    Postiz has developed the fix, verified it, created the release and published the advisory.

  4. 03/30/2026 17:51

    GitHub has assigned the CVE-2026-34576.