Skip to content
Heist/ feed
Back to feed
Medium

Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Type: advisorySources: OSV

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-34590
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:23 UTC · Revision 1

Source evidence

Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

core-osv · Original source

Published 2 Apr 2026, 17:26 UTC

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.

osv:CVE-2026-34590
Complete source record
{
  "id": "a787fa59168e561d90a822daacc1c29d8a031a6a9cbb4978d3cfc8a9b480355a",
  "url": "https://osv.dev/vulnerability/CVE-2026-34590",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation",
    "summary": "Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.",
    "evidence": "osv:CVE-2026-34590",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-34590",
      "aliases": [
        "CVE-2026-34590",
        "GHSA-wc9c-7cv8-m225"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/gitroomhq/postiz-app",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5ae4c950db6aa516a31454b7a45b9480bca40a11"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.21.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5ae4c950db6aa516a31454b7a45b9480bca40a11"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5ae4c950db6aa516a31454b7a45b9480bca40a11"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.21.4"
                  },
                  {
                    "cpe": "cpe:2.3:a:gitroom:postiz:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.21.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.21.3",
            "v2.21.2",
            "v2.21.1",
            "v2.21.0",
            "v2.20.2",
            "v2.20.1",
            "v2.20.0",
            "v2.19.0",
            "v2.18.0",
            "v2.17.0",
            "v2.16.0",
            "v2.15.1",
            "v2.15.0",
            "v2.14.0",
            "v2.13.0",
            "v2.12.1",
            "v2.12.0",
            "v2.11.3",
            "v2.11.1",
            "v2.11.0",
            "v2.10.1",
            "v2.10.0",
            "v2.9.0",
            "v2.8.3",
            "v2.8.2",
            "v2.8.1",
            "v2.8.0",
            "v2.7.0",
            "v2.6.4",
            "v2.6.3",
            "v2.6.2",
            "v2.6.1",
            "v2.5.4",
            "v2.5.3",
            "v2.4.3",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.1",
            "v2.3.0",
            "v2.2.5",
            "v2.2.4",
            "v2.2.3",
            "v2.2.1",
            "v2.2.0",
            "v2.1.2",
            "v2.1.1",
            "v2.0.8",
            "v2.0.7",
            "v2.0.6",
            "v2.0.5",
            "v2.0.4",
            "v2.0.3",
            "v2.0.2",
            "v2.0.1",
            "v1.65.7",
            "v1.65.6",
            "v1.65.5",
            "v1.65.4",
            "v1.65.3",
            "v1.65.2",
            "v1.65.1",
            "v1.65.0",
            "v1.64.1",
            "v1.64.0",
            "v1.63.0",
            "v1.62.3",
            "v1.62.2",
            "v1.62.1",
            "v1.62.0",
            "v1.61.2",
            "v1.61.0",
            "v1.60.1",
            "v1.60.0",
            "v1.59.0",
            "v1.58.0",
            "v1.57.0",
            "v1.56.0",
            "v1.55.5",
            "v1.54.0",
            "v1.55.4",
            "v1.55.3",
            "v1.55.2",
            "v1.55.1",
            "v1.55.0",
            "v1.54.1",
            "v1.53.0",
            "v1.52.2",
            "v1.52.1",
            "v1.52.0",
            "v1.51.0",
            "v1.50.0",
            "v1.49.1",
            "v1.49.0",
            "v1.48.4",
            "v1.48.3",
            "v1.48.2",
            "v1.48.1",
            "v1.47.0",
            "v1.45.1",
            "v1.44.2",
            "v1.44.1",
            "v1.43.5",
            "v1.43.4",
            "v1.43.3",
            "v1.43.2",
            "v1.43.1",
            "v1.43.0",
            "v1.41.1",
            "v1.41.0",
            "v1.40.1",
            "v1.40.0",
            "v1.39.3",
            "v1.39.2",
            "v1.38.2",
            "v1.38.1",
            "v1.37.4",
            "v1.37.3",
            "v1.37.2",
            "v1.37.1",
            "v1.36.1",
            "v1.35.1",
            "v1.34.1",
            "v1.33.2",
            "v1.33.1",
            "v1.32.1",
            "v1.31.1",
            "v1.30.1",
            "v1.29.1",
            "v1.28.1",
            "v1.27.2",
            "v1.26.1",
            "v1.24.1",
            "v1.23.2",
            "v1.23.1",
            "v1.22.1",
            "v1.10.1",
            "v1.10.0",
            "v1.8.1",
            "v1.7.12",
            "v1.6.12",
            "v1.6.9",
            "v1.6.4",
            "v1.6.2",
            "v1.6.1",
            "1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0",
            "v0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34590.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.308534267Z",
      "provider": "osv",
      "references": [
        "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.4",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34590.json",
        "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-wc9c-7cv8-m225",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-34590",
        "https://github.com/gitroomhq/postiz-app/commit/5ae4c950db6aa516a31454b7a45b9480bca40a11"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-918"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34590.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-34590",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522180,
  "published_at": "2026-04-02T17:26:58.902+00:00"
}