Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceGHSA-vj2p-7pgw-g2wf

GHSA-vj2p-7pgw-g2wf

HIGH7.5

Postiz App has a High-Severity SSRF Vulnerability via Next.js

Published Mar 27, 2026

Modified 2 weeks ago

Details

Impact

A successful SSRF attack allows an attacker to:

Bypass firewalls to scan and interact with internal network services/ports.
Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.
Pivot into the internal network environment where Postiz is hosted.

Workarounds

There are no workarounds known to this, please upgrade to Postiz version v2.21.1.

Affected Packages

postiz

npm

References

https://github.com/advisories/GHSA-vj2p-7pgw-g2wf

https://github.com/gitroomhq/postiz-app

https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-vj2p-7pgw-g2wf

https://github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g

https://nvd.nist.gov/vuln/detail/CVE-2024-34351

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Ecosystems

Timeline

PublishedMar 27, 2026

ModifiedMar 27, 2026

GHSA-vj2p-7pgw-g2wf | Mondoo Vulnerability Intelligence