CVE-2026-40487

HighPublic PoC

Published: 18 April 2026

Published

18 April 2026

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

EPSS Score 0.0002 5.7th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40487 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gitroom Postiz. Its CVSS base score is 8.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as Machine Learning Libraries.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the file upload validation bypass by requiring comprehensive validation of uploaded file content and types beyond spoofed Content-Type headers.

SI-15 Information Output Filtering good match

prevent

Mitigates stored XSS by filtering output of served files to neutralize executable HTML, SVG, or script content.

SI-3 Malicious Code Protection partial match

preventdetect

Provides malicious code protection mechanisms to scan and block dangerous executable files or XSS payloads during upload.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

The vulnerability is a file upload bypass in a public-facing web application that enables delivery of malicious HTML/SVG/JS content resulting in stored XSS and arbitrary JavaScript execution in victim browsers, directly mapping to T1190 (exploiting the public-facing app) and T1059.007 (abusing JavaScript for execution).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The…

uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cross-Site Scripting (XSS) in the context of the application's origin. This can lead to session riding, account takeover, and full compromise of other users' accounts. Version 2.21.6 contains a fix.

Deeper analysisAI

CVE-2026-40487 is a file upload validation bypass vulnerability in Postiz, an AI social media scheduling tool, affecting versions prior to 2.21.6. The flaw allows authenticated users to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the Content-Type header. These uploaded files are served by nginx with a Content-Type derived from their original file extension, such as text/html or image/svg+xml, enabling stored Cross-Site Scripting (XSS) in the context of the application's origin. The vulnerability is associated with CWEs-79 (XSS), CWE-345 (insufficient verification of data authenticity), and CWE-434 (unrestricted upload of files with dangerous type), and carries a CVSS v3.1 base score of 8.9 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L).

Any authenticated user with low privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction. Attackers can upload malicious files that, when viewed or accessed by other users, execute JavaScript in the application's origin context. This enables session riding, account takeover, and full compromise of other users' accounts through the resulting stored XSS.

The GitHub security advisory (GHSA-44wg-r34q-hvfx) and release notes for version 2.21.6 confirm that updating to Postiz v2.21.6 resolves the issue by addressing the file upload validation bypass.