GHSA-vj2p-7pgw-g2wf
Postiz App has a High-Severity SSRF Vulnerability via Next.js
Impact
A successful SSRF attack allows an attacker to:
- Bypass firewalls to scan and interact with internal network services/ports.
- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.
- Pivot into the internal network environment where Postiz is hosted.
Workarounds
There are no workarounds known to this, please upgrade to Postiz version v2.21.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Postiz App has a High-Severity SSRF Vulnerability via Next.js
Impact
A successful SSRF attack allows an attacker to:
- Bypass firewalls to scan and interact with internal network services/ports.
- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.
- Pivot into the internal network environment where Postiz is hosted.
Workarounds
There are no workarounds known to this, please upgrade to Postiz version v2.21.1.
- Record
GHSA-vj2p-7pgw-g2wf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918, CWE-1395
- Updated
- 2026-11-02
OSV
Postiz App has a High-Severity SSRF Vulnerability via Next.js
Impact
A successful SSRF attack allows an attacker to:
- Bypass firewalls to scan and interact with internal network services/ports.
- Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.
- Pivot into the internal network environment where Postiz is hosted.
Workarounds
There are no workarounds known to this, please upgrade to Postiz version v2.21.1.
- Record
GHSA-vj2p-7pgw-g2wf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-1395, CWE-918
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postiznpm | through 2.0.12 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-vj2p-7pgw-g2wf is a high vulnerability (CVSS 7.5) in postiz, published March 27, 2026. No source lists public exploit code. No source names a fixed version.