CVE-2026-42346
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Postiz is an AI social media scheduling tool. In versions from 2.16.6 to 2.21.6, SSRF protections have a TOCTOU vulnerability: the isSafePublicHttpsUrl() function resolves DNS to validate the IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.
Risk Assessment
The risk involves bypassing SSRF protections and gaining access to internal network resources, potentially leading to data leakage or further attacks.
Recommendation
It is recommended to upgrade to version 2.21.7 or later.
Original NVD description (English source)
Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Check-Time-of-Use) vulnerability: isSafePublicHttpsUrl() resolves DNS to validate the target IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this gap via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.