Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 27 March 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-03-25: Postiz released fix in v2.21.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Gitroom Postiz or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Postiz App server-side request forgery via Next.js

Severity: low · CVSS 3.1 · Published 2026-03-27

Postiz, a social media management and posting application, contains a server-side request forgery (SSRF) vulnerability in its Next.js implementation. An unauthenticated remote attacker can exploit this flaw to access internal cloud metadata services (such as AWS IMDS) and internal network resources, potentially leaking cloud credentials or compromising internal systems where Postiz is deployed.

Technologies: Gitroom Postiz, Vercel Next.js. Vendors: Gitroom, Vercel.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 27 March 2026.
Which products and versions are affected?: Gitroom Postiz < 2.21.1; Vercel Next.js >=13.4, <14.1.1.
Is there a fix for This vulnerability?: A patch was published on 2026-03-25: Postiz released fix in v2.21.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Gitroom Postiz or Vercel Next.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a server-side request forgery (SSRF) vulnerability (CWE-918) that arises from Postiz's use of Next.js Server Actions. The root cause lies in improper validation of Host headers in Next.js versions prior to 14.1.1 when Server Actions perform redirects to relative paths beginning with "/". An attacker can modify the Host header and craft malicious requests that appear to originate from the application server itself, allowing requests to internal resources without authentication. The vulnerability requires no user interaction and is network-reachable. Successful exploitation enables attackers to bypass firewall protections, scan internal network services, access cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), and potentially exfiltrate cloud credentials or pivot into the internal network. The patch is available in Postiz v2.21.1 and Next.js 14.1.1+.

Affected products

Gitroom Postiz < 2.21.1
Vercel Next.js >=13.4, <14.1.1

Timeline

2026-03-27: disclosed: Advisory published to GitHub Security Advisory Database
2026-03-25: patched: Postiz released fix in v2.21.1
2026-03-24: other: Initial vulnerability report received by Postiz

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.