CVE-2026-40487: Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the Content-Type header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (text/html, image/svg+xml), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40487?
CVE-2026-40487 is classified as a high-severity vulnerability due to the potential for stored XSS attacks.
How do I fix CVE-2026-40487?
To fix CVE-2026-40487, upgrade Postiz to version 2.21.6 or later to mitigate the unrestricted file upload issue.
What type of attack does CVE-2026-40487 enable?
CVE-2026-40487 enables stored Cross-Site Scripting (XSS) attacks through arbitrary file uploads.
Who is affected by CVE-2026-40487?
CVE-2026-40487 affects all authenticated users of Postiz versions prior to 2.21.6.
How does CVE-2026-40487 exploit file uploads?
CVE-2026-40487 exploits file uploads by allowing attackers to spoof MIME types, bypassing validation and uploading malicious files.