CVE-2026-42556: Postiz stored XSS in public preview page
Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Postizto a version that resolves this vulnerability.Fixed in 2.21.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42556?
CVE-2026-42556 is categorized as a medium severity stored XSS vulnerability affecting Postiz versions 2.21.6 before 2.21.7.
How do I fix CVE-2026-42556?
To address CVE-2026-42556, upgrade to Postiz version 2.21.7 or later.
Who is affected by CVE-2026-42556?
Any authenticated user of Postiz versions 2.21.6 to before 2.21.7 can be affected by CVE-2026-42556.
What is the nature of CVE-2026-42556?
CVE-2026-42556 is a stored cross-site scripting (XSS) vulnerability that allows arbitrary HTML to be stored in post content.
How can attackers exploit CVE-2026-42556?
Attackers can exploit CVE-2026-42556 by manipulating save requests to include malicious HTML in posts.