Vulnerability Report

CVE-2026-40487

Title: File Upload Validation Bypass leading to Stored XSS

XSS

Proof Of Concept

PoC Available for CVE-2026-40487

CWE Category CWE-79
Published Date Apr 18, 2026
Modified Date Apr 23, 2026
Exploit Status Available
Score 8.9 CVSS v3.1
Exploit Probability (EPSS)
0.26%

Vulnerability Summary

CVE-2026-40487: Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

Impacted Vendors

G
gitroom 1

Reference Links

https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.6 https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfx
CVSS v3.1
Source Entity [email protected]
Severity HIGH
8.9
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.0
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-40487 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Astaruf/CVE-2026-40487
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction REQUIRED
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Affected Stack

No specific products linked.