Vendor

Postiz

1 brief RSS

Postiz File Upload Vulnerability Leads to Stored XSS (CVE-2026-40487)

An authenticated file upload validation bypass in Postiz prior to version 2.21.6 allows attackers to upload arbitrary HTML, SVG, or other executable file types by spoofing the `Content-Type` header, resulting in stored XSS and potential account takeover.

Postiz xss file-upload vulnerability cve-2026-40487

2r 5t 1c Jan 30, 2024