CVE-2026-113671 Details
Description
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or the stored-provider and absolute-storage configurations. This issue is fixed in AI helper 1.0.0-beta.13.
A server-side request forgery (SSRF) vulnerability has been identified in the ApostropheCMS AI helper module, specifically in versions 1.0.0-beta.10 prior to 1.0.0-beta.13. The issue arises when an editor with image-generation capabilities creates a base64 image record that lacks a provider URL. The vulnerability allows the editor to invoke image acceptance on a deployment using local relative storage, without a trusted global base URL. Exploitation involves sending a request with a manipulated Host header, which the server uses to resolve the image fetch origin. This enables controlled server-side requests to an attacker-selected host, port, and HTTP origin, but does not allow arbitrary path retrieval or access to the stored provider and absolute storage configurations.
Users can update to ApostropheCMS AI Helper version 1.0.0-beta.13, which addresses the vulnerability by implementing proper authorization checks and validating the fetch origin before making server-side requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-527g-ff96-x6wj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350 | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/[email protected] | [email protected] | Source CodeVendor |
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-527g-ff96-x6wj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS AI helper | >= 1.0.0-beta.10, <= 1.0.0-beta.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |