CVE-2026-42556

9.0 Critique

Publiée le 09/05/2026 à 01:16 · Modifiée le 24/07/2026 à 23:10 · Analysée par le NVD · Source : security-advisories@github.com

Description

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.9 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L`
3.1	9.0 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-79

Références

https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7 ProductRelease Notes
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-hhxq-3wg7-4rj8 Vendor Advisory

CVE-2026-42556

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs