CVE-2026-40487

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

• CWE-79
• CWE-345
• CWE-434

• https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6Product, Release Notes
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfxExploit, Vendor Advisory
• https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfxExploit, Vendor Advisory

Published

Apr 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40481monetr is a budgeting application for recurring expenses. In…7.5
• CVE-2026-40482ChurchCRM is an open-source church management system. Versio…7.1
• CVE-2026-40483ChurchCRM is an open-source church management system. In ver…5.4
• CVE-2026-40484ChurchCRM is an open-source church management system. In ver…9.1
• CVE-2026-40485ChurchCRM is an open-source church management system. In ver…5.3
• CVE-2026-40486Kimai is an open-source time tracking application. In versio…4.3
• CVE-2026-40488Magento Long Term Support (LTS) is an unofficial, community-…8.8
• CVE-2026-40489editorconfig-core-c is an EditorConfig core library for use…8.6
• CVE-2026-4049Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-40490The AsyncHttpClient (AHC) library allows Java applications t…6.8
• CVE-2026-40491gdown is a Google Drive public file/folder downloader. Versi…7.8
• CVE-2026-40492SAIL is a cross-platform library for loading and saving imag…9.8