CVE-2026-53607: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

Vulnerability summary

CVE-2026-53607 is a low (CVSS 3.7) Server-Side Request Forgery (SSRF) vulnerability in apostrophecms apostrophe. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.6% of scored vulnerabilities.

Timeline

1. 12-06-2026
   PublishedVulnerability first disclosed.
2. 15-06-2026
   Last modifiedVulnerability information updated.

Description

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header. That URL is then `fetch`'ed and the response body + headers are streamed straight back to the requester. Because `Host` is fully attacker-controlled, an unauthenticated remote attacker can pivot the apostrophe process to issue outbound HTTP requests against any host it can reach on the private network. The path component is constrained to `/uploads/attachments/<cuid>-<slug>.<ext>` (built from a local-DB lookup), which keeps the impact narrow: cross-instance data exfiltration is neutralized by cuid uniqueness, but blind-SSRF residuals remain (network-topology mapping via response-code / timing differences and verbose proxy/WAF 404 body disclosure). As of time of publication, no known patched versions exist.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.