CVE-2026-42556 is a stored cross site scripting flaw (CVSS 8.9, high) in Postiz version 2.21.6, an AI social media scheduling tool. A logged in user can save arbitrary HTML in a post and send the public preview link to someone else. Upgrade to Postiz 2.21.7 or later.
What's affected
The advisory lists Postiz from 2.21.6 and says the patched version is 2.21.7. The NVD record words it as 2.21.6 to before 2.21.7.
The advisory timeline shows the maintainers received the report on 20 April 2026, verified a fix on 27 April and released it the same day. It states that no reliable workaround exists before 2.21.7.
How to check if you're exposed
- Find the Postiz version or image tag you deploy. If you run it with Docker, read the tag in your compose file or the running container.
- Anything at 2.21.6 is affected, and so is any build that predates the fix.
- List who can create posts. The attacker needs a valid account that can create a post, so the number of accounts matters.
- Look at saved posts for unexpected HTML in their content, and review which preview links have been shared.
What to do now
- Upgrade to Postiz 2.21.7 or later.
- Review the accounts that can create posts and remove any you do not recognise.
- Review stored post content for markup that should not be there.
- Consider logging users out and rotating sessions after the upgrade, since script on the main origin can act as the viewer.
- Avoid opening share preview links from people you do not know until you have patched.
Why it matters
The weakness is CWE-79, cross site scripting. The preview page renders saved post content with React's dangerouslySetInnerHTML, which inserts raw HTML without cleaning it. The save request let a user store markup of their choice, and the preview page ran it.
What raises the severity is where it runs. The preview is served from the main application origin, so injected script runs with the viewer's session. That is why the scope is rated changed. The KEV flag is false, and the advisory I read does not claim exploitation in the wild.
Quick check
Is there a workaround if I cannot upgrade now?
The advisory says no reliable workaround exists before 2.21.7, so upgrade.
Sources
Last reviewed: 19 October 2026.
