CVE-2026-53607

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.31.0

Description When the prettyUrls: true setting is enabled on the @apostrophecms/file module, the public pretty-URL handler constructs an upstream URL using the raw Host HTTP request header. This URL is then processed via a fetch operation, and the resulting response body and headers are streamed back to the requester. Since the Host header is controlled by the user, an unauthenticated remote attacker can force the process to issue outbound HTTP requests to any reachable host on the private network. This results in a blind Server-Side Request Forgery (SSRF), which is a flaw where a server is tricked into making requests to an unintended location. While the path is limited to /uploads/attachments/<cuid>-<slug>.<ext>, attackers can still perform network-topology mapping by analyzing response codes, timing differences, or verbose proxy and WAF 404 body disclosures.

Recommendations As a temporary workaround, disable the prettyUrls: true setting on the @apostrophecms/file module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.