CVE-2026-40487

OVERVIEW CVE-2026-40487 is a file upload validation bypass vulnerability affecting Postiz, an AI-powered social media scheduling application. Versions prior to 2.21.6 allow authenticated users to circumvent upload restrictions by spoofing the Content-Type header, enabling them to upload arbitrary executable files including HTML, SVG, and other potentially malicious file types. When nginx serves these files based on their actual file extensions, the stored content is rendered with executable MIME types in the application's security context. SEVERITY This vulnerability carries a CRITICAL CVSS score of 9.0 due to its low attack complexity and significant impact potential. The attack requires low privileges (authenticated user status) and user interaction, but operates over the network with no special configuration required. The stored XSS enables threat actors to conduct session hijacking, execute account takeover attacks, and achieve complete compromise of other users' accounts within the Postiz application. EXPLOITATION STATUS Currently, there is no indication of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog, and community engagement remains limited. However, the exploit concept is straightforward to implement given the reliance on client-side header manipulation, making it important for administrators to apply the patched version 2.21.6 promptly to prevent potential future exploitation.