CVE-2026-53607

Vulnerability

An unauthenticated blind server-side request forgery (SSRF) exists in ApostropheCMS versions up to and including 4.30.0 when the prettyUrls: true option is enabled on the @apostrophecms/file module. The public pretty-URL handler constructs an upstream URL using the raw Host HTTP request header proxyUrl = ${req.protocol}://${req.get('host')}${uglyUrl}`, then fetches that URL and streams the response back to the requester. The path component is constrained to /uploads/attachments/-.` (derived from a local database lookup), limiting the attack surface. The feature is described in the documentation as an SEO improvement for serving uploaded files [1].

Exploitation

An attacker with no authentication or network access beyond the ability to send HTTP requests to the targeted ApostropheCMS instance can exploit this by setting the Host header to an arbitrary internal or external hostname. The constrained path reduces the impact to response-code and timing side channels, as well as verbose proxy/WAF 404 body disclosure [1].

Impact

Successful exploitation yields a blind SSRF, allowing the attacker to map internal network topology, infer services from response codes or timing differences, and potentially obtain verbose error pages from internal proxies or WAFs. Cross-instance data exfiltration is neutralized by cuid uniqueness — an attacker cannot predict a valid attachment path on another instance [1].

Mitigation

As of the publication date, no patched version is available. Users should disable prettyUrls: true on @apostrophecms/file if possible, or restrict access to the vulnerable endpoint (e.g., via a reverse proxy) to trusted networks only [1].