Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 27 March 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-03-25: Version 2.21.2 released with SSRF protections Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Gitroom Postiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Postiz multiple SSRF vulnerabilities in webhooks, RSS feed, and URL loader

Severity: medium · CVSS 4 · Published 2026-03-27

Postiz is a social media management and automation platform that allows users to manage webhooks, RSS feeds, and content loading. The application fails to validate user-supplied URLs before fetching them server-side, allowing attackers to access internal networks, cloud metadata services (such as AWS credentials), and private IP ranges without authentication or user interaction.

Technologies: Gitroom Postiz. Vendors: Gitroom.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 27 March 2026.
Which products and versions are affected?: Gitroom Postiz 0 to 2.0.12.
Is there a fix for This vulnerability?: A patch was published on 2026-03-25: Version 2.21.2 released with SSRF protections Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Gitroom Postiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Postiz contains multiple Server-Side Request Forgery (SSRF) vulnerabilities across four distinct endpoints: the webhook send endpoint accepts arbitrary URLs via query parameters, stored webhooks are delivered to URLs without validation, RSS/XML feed parsing fetches URLs directly, and HTML content loader retrieves arbitrary URLs. The root cause is the absence of IP validation, private IP filtering, cloud metadata endpoint blocking, and DNS rebinding protection. All four vectors are network-accessible without authentication. An attacker can retrieve AWS/GCP/Azure metadata credentials, scan internal networks, access private services on RFC 1918 ranges, and exploit multiple entry points simultaneously. The vulnerability was patched in version 2.21.2 (released 2026-03-25), which introduced URL filtering protections.

Affected products

GitRoom Postiz 0 to 2.0.12

Timeline

2026-03-04: disclosed: Report privately disclosed to Postiz
2026-03-25: other: Postiz acknowledged report and created fix
2026-03-25: patched: Version 2.21.2 released with SSRF protections
2026-03-27: advisory: Public advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.