Description
Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.
INFO
Published Date :
2026-04-18T01:19:06.588Z
Last Modified :
2026-04-20T15:25:40.893Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-40487 vulnerability.
| Vendors | Products |
|---|---|
| Gitroom |
|
| Gitroomhq |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40487.
