CVE-2026-53607 Details
Description
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header. That URL is then `fetch`'ed and the response body + headers are streamed straight back to the requester. Because `Host` is fully attacker-controlled, an unauthenticated remote attacker can pivot the apostrophe process to issue outbound HTTP requests against any host it can reach on the private network. The path component is constrained to `/uploads/attachments/<cuid>-<slug>.<ext>` (built from a local-DB lookup), which keeps the impact narrow: cross-instance data exfiltration is neutralized by cuid uniqueness, but blind-SSRF residuals remain (network-topology mapping via response-code / timing differences and verbose proxy/WAF 404 body disclosure). As of time of publication, no known patched versions exist.
A blind server-side request forgery (SSRF) vulnerability has been identified in ApostropheCMS versions through 4.30.0. When the 'prettyUrls' option is enabled in the '@apostrophecms/file' module, the public pretty-URL handler constructs upstream URLs using the raw 'Host' HTTP request header. This allows an unauthenticated remote attacker to manipulate the 'Host' header and cause the Apostrophe process to make outbound HTTP requests to internal services on the private network. The vulnerability is limited to the path '/uploads/attachments/<cuid>-<slug>.<ext>', which is derived from a local database lookup, preventing cross-instance data exfiltration but leaving residual blind SSRF effects, such as network topology mapping and verbose proxy or WAF 404 body disclosure.
To address this vulnerability, it is recommended to stop using the 'Host' header to derive upstream URLs. Instead, use a server-trusted absolute base URL and enforce an origin allowlist before making outbound requests. Additionally, a regression test should be implemented to ensure the vulnerability is properly mitigated.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-34pj-2622-jvxq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-34pj-2622-jvxq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS | <= 4.30.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |