CVE-2026-34577: Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources. This issue has been patched in version 2.21.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Postizto a version that resolves this vulnerability.Fixed in 2.21.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34577?
CVE-2026-34577 is considered a high severity vulnerability due to its potential for causing unauthorized access to internal resources.
How do I fix CVE-2026-34577?
To mitigate CVE-2026-34577, upgrade Postiz to version 2.21.3 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2026-34577?
CVE-2026-34577 is classified as an Unauthenticated Full-Read Server-Side Request Forgery (SSRF) vulnerability.
What are the implications of exploitation of CVE-2026-34577?
Exploitation of CVE-2026-34577 allows attackers to access internal services and sensitive data by manipulating the URL parameter.
Which versions of Postiz are affected by CVE-2026-34577?
CVE-2026-34577 affects all versions of Postiz prior to version 2.21.3.