GHSA-vj2p-7pgw-g2wf: Postiz App has a High-Severity SSRF Vulnerability via Next.js

March 27, 2026

A successful SSRF attack allows an attacker to:

Bypass firewalls to scan and interact with internal network services/ports.
Access sensitive cloud metadata services (e.g., AWS IMDS 169.254.169.254) to potentially leak instance credentials.
Pivot into the internal network environment where Postiz is hosted.

References

github.com/advisories/GHSA-vj2p-7pgw-g2wf
github.com/gitroomhq/postiz-app
github.com/gitroomhq/postiz-app/security/advisories/GHSA-vj2p-7pgw-g2wf
github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
nvd.nist.gov/vuln/detail/CVE-2024-34351

Code Behaviors & Features

Detect and mitigate GHSA-vj2p-7pgw-g2wf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →