PT-2026-39216 · Postiz · Postiz

Levu12 · CVE-2026-42556 · Published 2026-05-08 · Updated 2026-05-09

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Postiz versions 2.21.6 through 2.21.6

Description Authenticated users with post creation privileges can store arbitrary HTML within post content by tampering with their save request. This content is then rendered on the main application origin using dangerouslySetInnerHTML when a user visits the public preview link "/p/?share=true".

Recommendations Update to version 2.21.7.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42556

GHSA-HHXQ-3WG7-4RJ8

Affected Products

Postiz

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42556.json · Exploit
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-hhxq-3wg7-4rj8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-42556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42556 · Security Note
• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 · Note
• https://t.me/CVEtracker/53181 · Telegram Post
• https://twitter.com/CVEnew/status/2053131416238752091 · Twitter Post