CVE-2026-53607: ApostropheCMS SSRF in @apostrophecms/file via Host header

CVE-2026-53607 · Severity: low · CVSS 3.7 · Published 2026-06-12

Apostrophe is a popular Node.js-based content management system. When the optional pretty-URL feature is enabled for file serving, the application fails to validate the Host HTTP header when constructing internal proxy URLs. An unauthenticated attacker can exploit this to make the Apostrophe server itself fetch arbitrary URLs on its private network and return the response body, enabling reconnaissance of internal services and potential data exfiltration from verbose error pages or internal proxies.

Technologies: Apostrophe CMS, ApostropheCMS, apostrophe (npm). Vendors: Apostrophe, ApostropheCMS, npm.

Quick answers

Is CVE-2026-53607 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53607 being exploited in the wild.
How severe is CVE-2026-53607?
Low severity, with a CVSS score of 3.7, published 12 June 2026.
Which products and versions are affected?
Apostrophe CMS ≤ 4.30.0; ApostropheCMS <= 4.30.0; apostrophe (npm) <= 4.30.0, SEMVER:introduced=0,fixed=4.31.0.
Is there a fix for CVE-2026-53607?
Yes. apostrophe (npm): upgrade to 4.31.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53607 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-53607?
Check whether you run Apostrophe CMS, ApostropheCMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • apostrophe (npm): upgrade to 4.31.0 or later
    npm install apostrophe@4.31.0

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the @apostrophecms/file module's pretty-URL handler. When prettyUrls: true is configured, the public GET route constructs an upstream proxy URL by directly embedding the untrusted Host HTTP request header: `proxyUrl = ${req.protocol}://${req.get('host')}${uglyUrl}`. This URL is then passed to fetch() without validation. An attacker can supply an arbitrary Host header (e.g., `Host: internal-service`) to pivot the Apostrophe process into issuing requests to internal network addresses. The path component is constrained by database lookup to `/uploads/attachments/<cuid>-<slug>.<ext>`, narrowing the impact; however, blind SSRF remains viable via response codes and timing side-channels, and data exfiltration occurs against verbose proxies/WAFs. Exploitation requires prettyUrls: true (a documented production option), local uploadfs (the default), and knowledge of at least one valid file slug (publicly enumerable in page content). No fixed release exists as of the advisory date; affected versions are Apostrophe ≤ 4.30.0.

Affected products

  • Apostrophe CMS apostrophe ≤ 4.30.0

Identifiers

  • CVE-2026-53607
  • GHSA-34pj-2622-jvxq

Timeline

  • 2026-07-31: disclosed: Advisory published on OSV and GitHub
  • 2026-06-10: patched: Patch merged in PR #5464 / commit 5a88e96 (Latest security q2)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.