Executive brief
Postiz is a social media management and automation platform that allows users to manage webhooks, RSS feeds, and content loading. The application fails to validate user-supplied URLs before fetching them server-side, allowing attackers to access internal networks, cloud metadata services (such as AWS credentials), and private IP ranges without authentication or user interaction.
Technical details
Postiz contains multiple Server-Side Request Forgery (SSRF) vulnerabilities across four distinct endpoints: the webhook send endpoint accepts arbitrary URLs via query parameters, stored webhooks are delivered to URLs without validation, RSS/XML feed parsing fetches URLs directly, and HTML content loader retrieves arbitrary URLs. The root cause is the absence of IP validation, private IP filtering, cloud metadata endpoint blocking, and DNS rebinding protection. All four vectors are network-accessible without authentication. An attacker can retrieve AWS/GCP/Azure metadata credentials, scan internal networks, access private services on RFC 1918 ranges, and exploit multiple entry points simultaneously. The vulnerability was patched in version 2.21.2 (released 2026-03-25), which introduced URL filtering protections.
Affected products
- GitRoom Postiz 0 to 2.0.12
Timeline
- 2026-03-04: disclosed: Report privately disclosed to Postiz
- 2026-03-25: other: Postiz acknowledged report and created fix
- 2026-03-25: patched: Version 2.21.2 released with SSRF protections
- 2026-03-27: advisory: Public advisory published