Postiz permite la mutación de encabezados en el middleware, facilitando un SSRF

The SSRF vulnerability in Postiz allows an attacker to craft malicious HTTP requests through the injection of arbitrary headers. This can be exploited to access internal resources that are not publicly accessible, potentially exposing sensitive data or allowing the attacker to interact with internal services. An attacker could, for example, scan internal network ranges, attempt to access cloud metadata services, or even interact with internal APIs. The blast radius extends to any internal systems accessible via outbound HTTP requests from the Postiz server, making this a potentially serious security risk.

Organizations using Postiz for social media scheduling, particularly those with sensitive internal data or systems accessible via outbound HTTP requests, are at risk. Shared hosting environments where Postiz is installed alongside other applications may also be vulnerable, as a compromise of one application could potentially lead to exploitation of this SSRF vulnerability.

• nodejs: Monitor Postiz application logs for unusual outbound HTTP requests, particularly those originating from internal IP addresses or containing unexpected headers.

grep -i 'internal.ip.address' /var/log/postiz/access.log

• generic web: Use curl to test for SSRF by attempting to access internal resources through the Postiz application.

curl -H "X-Custom-Header: http://169.254.169.254/latest/meta-data/" http://<postiz_server_ip>

• generic web: Examine Postiz's access and error logs for any signs of header injection attempts or unusual outbound requests.

1. 2025-07-11Disclosure

   disclosure

1. Reservado2025-07-07
2. Publicada2025-07-11
3. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-53641 is to immediately upgrade Postiz to version 1.62.3 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) to filter out requests containing suspicious HTTP headers. Specifically, look for patterns indicative of header injection attempts. Additionally, review Postiz's configuration to ensure it adheres to the principle of least privilege, limiting its access to external resources. After upgrading, confirm the fix by attempting to trigger an outbound request with a crafted HTTP header and verifying that it is blocked or handled securely.