CVE-2026-40487

[CVE catalog]

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

Severity

High · CVSS 8.9CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Published

Apr 18, 2026, 2:16:11 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.22% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "postiz",
      "ecosystem": "cpe",
      "fixed_version": "2.21.6"
    },
    {
      "name": "postiz",
      "ranges": [
        {
          "fixed": "2.21.6",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "2.21.6",
      "provider_record_id": "NVD-CVE-2026-40487"
    }
  ]
}