CVE-2026-34576 Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata

High 8.3 Published 2 Apr 2026 Updated 2 Apr 2026

An authenticated user can exploit an SSRF vulnerability in the upload-from-url endpoint to access internal network resources and cloud metadata.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-34576?

CVE-2026-34576 is a high-severity server-side request forgery vulnerability in gitroomhq postiz-app, published on 2 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it server-side using axios.get() with no SSRF protections. The only validation is a file extension check (.png, .jpg, etc.) which is trivially bypassed by appending an image extension to any URL path. An authenticated API user can fetch internal network resources, cloud instance metadata, and other internal services, with the response data uploaded to storage and returned to the attacker. This issue has been patched in version 2.21.3.

Weakness: CWE-918

Which versions are affected by CVE-2026-34576?

It affects 1 product.

Products include Gitroom Postiz.

How do I fix CVE-2026-34576?

No fix has been published for CVE-2026-34576 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-34576 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34576 exists.

Sources

Also known as GHSA-89vp-m2qw-7v34.