GHSA-vj2p-7pgw-g2wf

Source

https://github.com/advisories/GHSA-vj2p-7pgw-g2wf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vj2p-7pgw-g2wf/GHSA-vj2p-7pgw-g2wf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vj2p-7pgw-g2wf

Published

2026-03-27T15:46:53Z

Modified

2026-03-27T16:04:59Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Postiz App has a High-Severity SSRF Vulnerability via Next.js

Details

Impact

A successful SSRF attack allows an attacker to:

Bypass firewalls to scan and interact with internal network services/ports.
Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.
Pivot into the internal network environment where Postiz is hosted.

Workarounds

There are no workarounds known to this, please upgrade to Postiz version v2.21.1.

Database specific

{
    "cwe_ids": [
        "CWE-1395",
        "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T15:46:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

npm / postiz

Package

Name: postiz; View open source insights on deps.dev
Purl: pkg:npm/postiz

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.0.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-vj2p-7pgw-g2wf/GHSA-vj2p-7pgw-g2wf.json"