Gitroom Postiz vulnerabilities

• gitroom postiz, gitroomhq postiz-app +1 more Postiz stored XSS in public preview page CVE-2026-42556 8.9 HighMay 8, 2026
• gitroom postiz, gitroomhq postiz-app +1 more Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev CVE-2026-42298 Public exploit 10.0 CriticalMay 8, 2026
• gitroom postiz, gitroomhq postiz-app +1 more Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS CVE-2026-40487 Public exploit 8.9 HighApril 18, 2026
• gitroom postiz, gitroomhq postiz-app +1 more Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream CVE-2026-40168 8.2 HighApril 10, 2026
• gitroom postiz, gitroomhq postiz-app +1 more Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation CVE-2026-34590 5.4 MediumApril 2, 2026
• gitroom postiz, gitroomhq postiz-app +1 more Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check CVE-2026-34577 8.6 HighApril 2, 2026
• gitroom postiz, gitroomhq postiz-app +1 more Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata CVE-2026-34576 8.3 HighApril 2, 2026