CVE-2026-40487

Name: CVE-2026-40487
Creator: NVD / NIST
Published: 2026-04-18T02:16:11.67+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9/10EPSS 0.22%

Last modified Jun 17, 2026

CVE-2026-40487 is a critical-severity vulnerability rated 9/10 on the CVSS scale. Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

Metrics

CVSS 3.1

9/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Probability

0.22%

13.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Gitroom	Postiz	< 2.21.6

References

https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6Product, Release Notes
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfxExploit, Vendor Advisory
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfxExploit, Vendor Advisory

Timeline

Published: Apr 18, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-40487?

How severe is CVE-2026-40487?

CVE-2026-40487 has a CVSS score of 9/10 (CRITICAL severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

How do I fix CVE-2026-40487?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-40487?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST