CVE-2025-53641

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53641
Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to initiate unauthorized outbound requests from the server hosting the Postiz application. This vulnerability is fixed in 1.62.3.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/gitroomhq/postiz-app/commit/65eca0e2f22155b43c78724ca43617ee52e42753
https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-48c8-25jq-m55f
Configurations

No configuration.

History

15 Jul 2025, 13:14

Type Values Removed Values Added
Summary
  • (es) Postiz es una herramienta de programación de redes sociales con IA. Desde la versión 1.45.1 hasta la 1.62.3, la aplicación frontend de Postiz permite a un atacante inyectar encabezados HTTP arbitrarios en la canalización del middleware. Esta falla habilita una condición de Server-Side Request Forgery (SSRF), que puede explotarse para iniciar solicitudes salientes no autorizadas desde el servidor que aloja la aplicación Postiz. Esta vulnerabilidad se corrigió en la versión 1.62.3.

11 Jul 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-11 18:15

Updated : 2025-07-15 13:14

NVD link : CVE-2025-53641

Mitre link : CVE-2025-53641

CVE.ORG link : CVE-2025-53641

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)