Executive brief
ApostropheCMS, a platform used for building and managing websites, contains a security flaw in how it handles rich-text content. An authorized user, such as a content editor, can trick the server into making requests to internal systems or external websites that should be off-limits. This could allow an attacker to scan internal networks or steal sensitive images and data by forcing the server to download and re-host them.
Technical details
An authenticated Server-Side Request Forgery (SSRF) exists in ApostropheCMS versions <= 4.29.0. The vulnerability is located in the rich-text widget's import flow, specifically within the `@apostrophecms/area/validate-widget` endpoint. When a widget payload contains `import.html`, the backend parses `<img>` tags and uses the `fetch()` API to retrieve the source URLs. Because these URLs are not properly validated, an authenticated attacker can provide internal or restricted URLs. If the response is an image, Apostrophe persists and re-hosts the file, allowing for data exfiltration. For non-image responses, the flaw can still be used for internal port scanning and service discovery. As of the advisory date, no patched version is available.
Affected products
- Apostrophe Technologies ApostropheCMS <= 4.29.0
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: NVD publication date