Skip to content
GAdvisory
PSA-2026-04-422GCVE-2026-34577GCVE-125-2026-04-422GApril 19, 2026
8.6 High

Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check

Affected (1)

  • gitroomhqpostiz-app
    • ≥ 0Fixed in 2.21.3Affected

    All other versions: Unaffected

Mitigations

Solutions

  • Upgrade to v2.21.3 or later.

Exploits

  • Full-Read Access to the internal network.

Overview

The GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources.

Severity

CVSS v3
8.6 High
8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Weaknesses (1)

References (3)

Credits (3)

  • offset
    Reporter · @offset
  • Enno Gelhaus
    Coordinator · @egelhaus
  • Nevo David
    Remediation developer · @nevo-david

Context

Impacts

  • Impacts could include: - Cloud credential theft: An attacker can read AWS/GCP/Azure instance metadata endpoints to steal IAM credentials, service account tokens, and other cloud secrets. This can lead to full cloud account compromise. - Internal network reconnaissance: The attacker can scan and read from internal services (databases, caches, admin panels) that are not exposed to the internet. - Data exfiltration: Any HTTP-accessible internal resource can be read and its content returned to the attacker. - Chaining potential: Stolen cloud credentials or internal service access can be leveraged for lateral movement, privilege escalation, and further exploitation.

Timeline

  1. 03/28/2026 13:05

    Postiz received the initial report of the vulnerability.

  2. 03/28/2026 16:57

    Postiz acknowledged and verified the vulnerability.

  3. 03/29/2026 07:15

    Postiz developed the fix, verified it works, created the release and published the advisory.

  4. 03/30/2026 17:52

    GitHub assigned the CVE CVE-2026-34577 for this advisory.

© 2026 Gelhaus Solutions