CVE-2026-34576: Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension check (.png, .jpg, etc.) which is trivially bypassed by appending an image extension to any URL path. An authenticated API user can fetch internal network resources, cloud instance metadata, and other internal services, with the response data uploaded to storage and returned to the attacker. This issue has been patched in version 2.21.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Postizto a version that resolves this vulnerability.Fixed in 2.21.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34576?
CVE-2026-34576 has a moderate severity level due to its potential for Server-Side Request Forgery (SSRF) attacks.
How can I mitigate CVE-2026-34576?
To mitigate CVE-2026-34576, users should upgrade Postiz to version 2.21.3 or later.
What systems are affected by CVE-2026-34576?
CVE-2026-34576 affects versions of Postiz prior to 2.21.3.
What type of vulnerability is CVE-2026-34576?
CVE-2026-34576 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What does CVE-2026-34576 allow an attacker to do?
CVE-2026-34576 allows attackers to fetch internal resources and cloud metadata through the upload-from-url endpoint.