https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T17:40:45.918361+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-34590 CVE-2026-34590 — Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation 2026-10-05T17:40:45.937538+00:00

Affected: gitroomhq postiz-app

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.