GitHub Advisoryadvisory · npm

GHSA-vj2p-7pgw-g2wf Postiz App has a High-Severity SSRF Vulnerability via Next.js

HIGH Published 2026-03-27 Modified 2026-03-27 Official page ↗
Ecosystem
npm
Packages
postiz
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1395, CWE-918
Reviewed
2026-03-27

Affected packages

• npm postiz: <= 2.0.12 (no fix yet)

Description

Impact A successful SSRF attack allows an attacker to: • Bypass firewalls to scan and interact with internal network services/ports. • Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials. • Pivot into the internal network environment where Postiz is hosted. Workarounds There are no workarounds known to this, please upgrade to Postiz version `v2.21.1`.

Related

Weakness · CWE (2)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-918 Server-Side Request Forgery weakness

References