CVE-2025-53641CWE-918

Postiz allows header mutation in middleware facilitates resulting in SSRF

High · published July 11, 2025

CVSS v3.1
8.2
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to initiate unauthorized outbound requests from the server hosting the Postiz application. This vulnerability is fixed in 1.62.3.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-07-11T17:28Z
EPSS history
Timeline
  • 11 JUL 17:28Z
    Postiz allows header mutation in middleware facilitates resulting in SSRF
    cvelistv5