Skip to content
Threat Feed
Subscribe

Product

Postiz

1 brief RSS
high advisory

Postiz File Upload Vulnerability Leads to Stored XSS (CVE-2026-40487)

An authenticated file upload validation bypass in Postiz prior to version 2.21.6 allows attackers to upload arbitrary HTML, SVG, or other executable file types by spoofing the `Content-Type` header, resulting in stored XSS and potential account takeover.

Postiz xss file-upload vulnerability cve-2026-40487
2r 5t 1c