CVE-2026-113671

Name of the Vulnerable Software and Affected Versions @apostrophecms/ai-helper versions 1.0.0-beta.10 through 1.0.0-beta.12

Description An authenticated editor can trigger a Server-Side Request Forgery (SSRF) by exploiting the way the server resolves image URLs. When a global base URL is not configured, the server derives the base URL from the HTTP Host header. An attacker can generate a base64 AI image record that lacks a stored provider URL and then send a PATCH request to the endpoint /api/v1/@apostrophecms/image/ai-helper/{ id} with a malicious Host header. This forces the server to issue an outbound GET request to an attacker-controlled origin at a fixed path (/uploads/ai-helper-images/<id>.png), allowing the attacker to probe internal hosts and ports. The issue is caused by the aiHelperImageUrl() and aiHelperFetchImage() functions trusting the req.baseUrl variable without proper validation or authorization checks on the accept route.

Recommendations Update @apostrophecms/ai-helper to version 1.0.0-beta.13. As a temporary mitigation, configure a global base URL to ensure the resolved origin remains fixed. Restrict server egress controls to prevent outbound requests from reaching sensitive internal hosts or metadata endpoints.