GHSA-vj2p-7pgw-g2wf
GHSA-vj2p-7pgw-g2wf · Postiz App has a High-Severity SSRF Vulnerability via Next.js
This page contains facts from public vulnerability sources. Check the original advisory before updating.
### Impact A successful SSRF attack allows an attacker to: - Bypass firewalls to scan and interact with internal network services/ports. - Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials. - Pivot into the internal network environment where Postiz is hosted. ### Workarounds There are no workarounds known to this, please upgrade to Postiz version `v2.21.1`.
CVSS 7.5 · High
- Published
- Updated
Stack: node
Affected products and versions
postiz npm
- Affected ranges
- SEMVER: ≤ 2.0.12
No fix published