CVE-2026-42556: Postiz XSS Vulnerability

CVE-2026-42556 Overview

CVE-2026-42556 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Postiz, an AI social media scheduling application. The flaw affects versions from 2.21.6 up to (but not including) 2.21.7. An authenticated user with permission to create a post can tamper with their own save request to embed arbitrary HTML in post content. When the attacker shares the public preview link /p/<postId>?share=true with another user, the preview page renders that stored HTML using React's dangerouslySetInnerHTML on the main application origin. The vendor patched the issue in version 2.21.7.

Critical Impact

Authenticated attackers can execute arbitrary JavaScript in a victim's browser session on the Postiz application origin, leading to account takeover, data theft, and integrity loss.

Affected Products

• Postiz (gitroomhq/postiz-app) version 2.21.6
• Postiz versions released before 2.21.7
• Self-hosted Postiz deployments using the affected releases

Discovery Timeline

• 2026-05-08 - CVE-2026-42556 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42556

Vulnerability Analysis

The vulnerability stems from unsafe rendering of user-controlled HTML on Postiz's public preview route. The application accepts post content from any authenticated user with post-creation rights. A malicious user can bypass client-side sanitization by tampering with the save request and submitting arbitrary HTML payloads, including <script> tags and event-handler attributes.

The stored content is later returned to the public preview endpoint at /p/<postId>?share=true. The preview page passes the raw HTML directly into a React component using dangerouslySetInnerHTML, which bypasses React's default escaping. Because the preview is served from the main application origin, the injected script executes in the same security context as authenticated Postiz sessions.

Root Cause

The root cause is missing server-side HTML sanitization combined with the use of dangerouslySetInnerHTML to render attacker-controlled content. The application relied on client-side controls for input validation, which an authenticated attacker trivially bypasses by intercepting and modifying the save API request.

Attack Vector

An authenticated Postiz user crafts a post containing a malicious HTML or JavaScript payload by tampering with the save request to the backend. The attacker then generates the public preview link /p/<postId>?share=true and distributes it to a target user. When the target opens the link, the preview page renders the malicious payload via dangerouslySetInnerHTML. The payload executes on the Postiz application origin, allowing the attacker to read session tokens, perform actions on behalf of the victim, or pivot to connected social media accounts. Exploitation requires the victim to click the shared link, satisfying the user interaction requirement.

Detection Methods for CVE-2026-42556

Indicators of Compromise

• Post records containing <script> tags, javascript: URIs, or HTML event handlers such as onerror, onload, or onclick in the content field.
• Access logs showing repeated requests to /p/<postId>?share=true followed by anomalous API calls from the viewing user's session.
• Outbound HTTP requests from browsers to attacker-controlled domains originating from the Postiz application origin.

Detection Strategies

• Audit the post content database table for stored HTML markup, comparing entries created between the deployment of 2.21.6 and the upgrade to 2.21.7.
• Deploy a Content Security Policy (CSP) report-only header to surface inline script execution attempts on preview pages.
• Inspect web application firewall (WAF) logs for POST requests to post-save endpoints carrying HTML payloads bypassing the standard editor format.

Monitoring Recommendations

• Monitor for unusual session token usage, including concurrent sessions from distinct IP addresses for the same Postiz account.
• Alert on unexpected changes to connected social account credentials or scheduled posts shortly after a preview link is opened.
• Capture and review the Referer and User-Agent patterns of clients accessing public preview URLs to identify scripted abuse.

How to Mitigate CVE-2026-42556

Immediate Actions Required

• Upgrade all Postiz instances to version 2.21.7 or later as published in the GitHub Release v2.21.7.
• Invalidate active session tokens for users who may have opened malicious preview links since 2.21.6 was deployed.
• Review and rotate OAuth tokens for connected social media platforms to contain potential abuse of pivoted access.

Patch Information

The maintainers fixed the vulnerability in Postiz version 2.21.7. See the GitHub Security Advisory GHSA-hhxq-3wg7-4rj8 for advisory details and the GitHub Release v2.21.7 for the release notes. The fix sanitizes stored post content and removes unsafe HTML rendering on the public preview route.

Workarounds

• Disable or restrict access to the public preview route /p/<postId>?share=true at the reverse proxy until the upgrade is applied.
• Restrict post creation permissions to trusted users only, reducing the population of accounts capable of staging stored payloads.
• Enforce a strict Content Security Policy that disallows inline scripts on application origins serving rendered post content.

# Configuration example: nginx rule to block the vulnerable preview route
location ~ ^/p/[^/]+$ {
    if ($arg_share = "true") {
        return 403;
    }
}