CVE-2026-40487CWE-345CWE-434CWE-79

Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS

High · published April 18, 2026

CVSS v3.1
8.9
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-18T01:19Z
EPSS history
Timeline
  • 18 APR 01:19Z
    Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
    cvelistv5