CVE-2026-40487 is a file upload validation bypass in Postiz, the social media scheduling tool, scored CVSS 8.9. A logged in user can upload HTML or SVG by spoofing the Content-Type header, producing stored cross site scripting. Postiz 2.21.6 fixes it.
What's affected
- Affected: Postiz before 2.21.6
- Fixed: 2.21.6
The advisory says nginx serves the uploaded files with a type taken from the file extension, such as text/html or image/svg+xml, so the browser runs them in the application's own origin. It lists the weaknesses as CWE-345, CWE-434 and CWE-79.
How to check if you're exposed
Find your Postiz version in the application or from the image tag you deploy. If you run it from containers:
docker ps --format '{{.Image}}' | grep -i postiz
Then look in the uploads directory for files with html, htm or svg extensions that nobody on your team put there.
What to do now
- Upgrade to Postiz 2.21.6 or later.
- Review the uploads directory for HTML and SVG files and remove ones you do not recognise.
- As the advisory suggests while you plan the upgrade, consider disabling uploads or serving the uploads path with a download disposition and a restrictive content security policy.
- Rotate sessions for users who may have opened unknown uploads.
- Review your user list and remove accounts that are not needed.
Why it matters
The primary weakness is CWE-79, cross site scripting, made possible by trusting a client supplied header. The upload code checks the declared type, but the web server then decides how to serve the file from its extension. When the two disagree, an attacker picks the one that runs in the browser.
Stored XSS in an application that holds social media account tokens is a serious position, because a script running as a victim can act as that victim. The advisory also notes tokens without an expiry claim. The record does not report exploitation in the wild.
Quick check
Does an attacker need an account?
Yes, the record describes any authenticated user. On a shared or open signup instance that may be a low bar.
Sources
Last reviewed: 19 October 2026.
