PT-2026-39216 · Postiz · Postiz

Levu12 · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-42556

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Postiz versions 2.21.6 through 2.21.6

Description Authenticated users with post creation privileges can store arbitrary HTML within post content by tampering with their save request. This content is then rendered on the main application origin using dangerouslySetInnerHTML when a user visits the public preview link "/p/?share=true".

Recommendations Update to version 2.21.7.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42556

Affected Products

Postiz

References · 5

• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-hhxq-3wg7-4rj8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42556 · Security Note
• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 · Note
• https://t.me/CVEtracker/53181 · Telegram Post
• https://twitter.com/CVEnew/status/2053131416238752091 · Twitter Post