PT-2026-33243 · Postiz · Postiz

Published 2026-04-16 · Updated 2026-04-20 · CVE-2026-40487

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Postiz versions prior to 2.21.6

Description Postiz is an open-source social media management tool with over 28 platform integrations. The software contains a flaw that allows arbitrary file upload through MIME-type spoofing, which can lead to stored cross-site scripting (XSS) and subsequent account takeover. This issue can be triggered if an agent reading an untrusted email or webpage is manipulated into executing unauthorized actions.

Recommendations Update to a version newer than 2.21.5.

Exploit

Fix

XSS

Insufficient Verification of Data Authenticity

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-345

CWE-434

Related Identifiers

CVE-2026-40487

Affected Products

Postiz

References · 8

• 🔥 https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40487 · Security Note
• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6 · Note
• https://twitter.com/CVEnew/status/2045467334693798265 · Twitter Post
• https://twitter.com/DarkWebInformer/status/2044834282787463272 · Twitter Post
• https://twitter.com/zench4n/status/2044566482655539393 · Twitter Post
• https://twitter.com/fofabot/status/2046149027939664132 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045411636614246434 · Twitter Post