Executive brief
Postiz, a social media management and posting application, contains a server-side request forgery (SSRF) vulnerability in its Next.js implementation. An unauthenticated remote attacker can exploit this flaw to access internal cloud metadata services (such as AWS IMDS) and internal network resources, potentially leaking cloud credentials or compromising internal systems where Postiz is deployed.
Technical details
This is a server-side request forgery (SSRF) vulnerability (CWE-918) that arises from Postiz's use of Next.js Server Actions. The root cause lies in improper validation of Host headers in Next.js versions prior to 14.1.1 when Server Actions perform redirects to relative paths beginning with "/". An attacker can modify the Host header and craft malicious requests that appear to originate from the application server itself, allowing requests to internal resources without authentication. The vulnerability requires no user interaction and is network-reachable. Successful exploitation enables attackers to bypass firewall protections, scan internal network services, access cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), and potentially exfiltrate cloud credentials or pivot into the internal network. The patch is available in Postiz v2.21.1 and Next.js 14.1.1+.
Affected products
- Gitroom Postiz < 2.21.1
- Vercel Next.js >=13.4, <14.1.1
Timeline
- 2026-03-27: disclosed: Advisory published to GitHub Security Advisory Database
- 2026-03-25: patched: Postiz released fix in v2.21.1
- 2026-03-24: other: Initial vulnerability report received by Postiz