Postiz Security Advisories
All advisories
PSA-2026-T0E4W0CVE-2026-42556GCVE-125-2026-T0E4W0April 27, 2026
7.1 High

Postiz stored XSS in public preview page

Postiz stored XSS in public preview page

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 2.21.6Fixed in 2.21.7Affected

    All other versions: Unaffected

Mitigations

Workarounds

  • No reliable workaround exists prior to v2.21.7.

Solutions

  • Upgrade to v2.21.7 or later.

Exploits

  • Stored Cross-Site Scripting (XSS) that allows any authenticated user to persistently compromise other users by using the post preview feature.

Overview

Any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin.

Severity

CVSS v4
7.1 High
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
Passive
Vuln Confidentiality
High
Vuln Integrity
High
Vuln Availability
Low
Sub Confidentiality
Low
Sub Integrity
Low
Sub Availability
None
CVSS v3
8.9 High
8.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low

Weaknesses (1)

References (2)

Credits (3)

  • Leo Vu
    Reporter · @levu12
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • Through clicking the upload link, the attacker can invite himself as an admin to the team, gaining full admin permissions.

  • Fully removing all posts & integrations of the team.

  • Gaining the API token of the victim, so persistent access can be ensured.

  • Gaining full API access, while impersonating the victim.

Timeline

  1. 04/20/2026 13:27

    Postiz has received the advisory.

  2. 04/22/2026 18:54

    Postiz has acknowledged & verified the advisory.

  3. 04/27/2026 08:02

    Postiz has developed a fix.

  4. 04/27/2026 19:34

    Postiz has verified the fix, created the release and released the advisory.