CVE-2026-34590CWE-918

Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Medium · published April 2, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-02T17:26Z
EPSS history
Timeline
  • 02 APR 17:26Z
    Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
    cvelistv5