Postiz AI Tool Vulnerability Allows Account Takeover via XSS

The National Vulnerability Database (NVD) reports a critical vulnerability, CVE-2026-40487, in Postiz, an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allowed any authenticated user to upload arbitrary HTML, SVG, or other executable file types. This was achieved by spoofing the Content-Type header, tricking the server into accepting malicious files.

Once uploaded, Nginx served these files with their original Content-Type (e.g., text/html, image/svg+xml), enabling Stored Cross-Site Scripting (XSS). The NVD highlights that this XSS attack executes in the context of the application’s origin, leading to severe consequences such as session riding, account takeover, and full compromise of other users’ accounts. This isn’t theoretical; it’s a direct path to widespread user compromise.

Postiz has addressed this flaw in version 2.21.6. The NVD assigns a CVSS v3.1 score of 8.9 (HIGH) to this vulnerability, underscoring its significant risk. This is a classic example of insufficient input validation leading to catastrophic output execution.