Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader
Date: 2026-03
Affected: npm/postiz
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: High
CWE: CWE-918

## Summary Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection. ## Vulnerable Code ### 1. Webhook Send Endpoint (Most Critical) **`apps/backend/src/api/routes/webhooks.controller.ts` lines 58-70:** ```typescript async sendWebhook(@Body() body: any, @Query('url') url: string) { try { await fetch(url, { // No URL validation method: 'POST', body: JSON.stringify(body), headers: { 'Content-Type': 'application/json' }, }); } catch (err) { } return { send: true }; } ``` Accepts arbitrary URL via query parameter and fetches directly. ### 2. Stored Webhook Delivery **`apps/orchestrator/src/activities/post.activity.ts` lines 256-281:** ```typescript async sendWebhooks(postId: string, orgId: string, integrationId: string) { const webhooks = await this._webhookService.getWebhooks(orgId); return Promise.all( webhooks.map(async (webhook) => { await fetch(webhook.url, { // Stored URL, no validation method: 'POST', body: JSON.stringify(post), }); }) ); } ``` ### 3. RSS/XML Feed Parser **`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 135:** ```typescript async loadXML(url: string) { const { items } = await parser.parseURL(url); // No URL validation } ``` ### 4. HTML Content Loader **`libraries/nestjs-libraries/src/database/prisma/autopost/autopost.service.ts` line 185:** ```typescript as


Mitigations:

Architectural layers (MAESTRO):