CVE-2026-34576

Name of the Vulnerable Software and Affected Versions Postiz versions prior to 2.21.3

Description An authenticated API user can perform Server-Side Request Forgery (SSRF)—a technique where the server is tricked into making requests to an unintended location—via the 'POST /public/v1/upload-from-url' endpoint. The application uses axios.get() to fetch a user-supplied URL without proper protections. The existing validation only checks for file extensions (such as .png or .jpg), which can be bypassed by appending an image extension to any URL path. This allows an attacker to fetch internal network resources, cloud instance metadata, and other internal services, with the resulting data being uploaded to storage and returned to the attacker.

Recommendations Update Postiz to version 2.21.3. Avoid using the 'POST /public/v1/upload-from-url' endpoint until the update is applied.