CVE-2026-53607: ApostropheCMS SSRF Vulnerability

CVE-2026-53607 Overview

CVE-2026-53607 is a Server-Side Request Forgery (SSRF) vulnerability in ApostropheCMS, an open-source Node.js content management system. The flaw affects versions up to and including 4.30.0 when prettyUrls: true is enabled on @apostrophecms/file. The public pretty-URL handler constructs the upstream URL using the attacker-controlled Host HTTP request header. The server then issues a fetch against that URL and streams the response back to the requester. An unauthenticated remote attacker can pivot the Apostrophe process to issue outbound HTTP requests against any host reachable on the private network. The vulnerability maps to CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can force the Apostrophe process to make outbound HTTP requests to internal network hosts, enabling blind SSRF for network topology mapping and reconnaissance.

Affected Products

ApostropheCMS versions up to and including 4.30.0
Installations with prettyUrls: true configured on @apostrophecms/file
Any deployment exposing the /uploads/attachments/ pretty-URL handler to untrusted clients

Discovery Timeline

2026-06-12 - CVE-2026-53607 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53607

Vulnerability Analysis

The vulnerability resides in the public pretty-URL handler exposed by the @apostrophecms/file module when prettyUrls: true is configured. The handler is documented as an SEO feature for serving uploaded files at clean URLs. When a request arrives, the handler builds an upstream URL by concatenating the raw Host HTTP request header with a path derived from a local database lookup. The Node.js process then performs a fetch against the constructed URL and streams both the response body and headers back to the requester.

The path component is constrained to /uploads/attachments/<cuid>-<slug>.<ext>, with the cuid value retrieved from a local database lookup. This constraint limits cross-instance data exfiltration because cuid values are unique per installation. However, the path constraint does not prevent the request from being issued. Attackers retain blind-SSRF residuals including network topology mapping through response code differences, request timing analysis, and verbose proxy or WAF 404 body disclosure.

Root Cause

The root cause is the use of an untrusted, client-controlled Host header as the authority component of a server-side fetch URL. The handler does not validate that the Host header matches an allowlist of expected hostnames before issuing the upstream request. This violates the principle that HTTP headers under client control must not be used to determine network destinations for server-initiated requests.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the public pretty-URL endpoint with a Host header set to an internal hostname or IP address. The server constructs an upstream URL such as http://<attacker-host-header>/uploads/attachments/<cuid>-<slug>.<ext> and issues a fetch request. The attacker observes timing differences, response codes, and any disclosed error body content to enumerate reachable internal services. No authentication, user interaction, or prior knowledge of internal cuid values is required to trigger the outbound request.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-34pj-2622-jvxq for the authoritative technical description.

Detection Methods for CVE-2026-53607

Indicators of Compromise

Inbound HTTP requests to /uploads/attachments/ paths containing Host header values that do not match the server's canonical hostname or configured domain allowlist.
Outbound HTTP connections from the Apostrophe Node.js process to internal RFC1918 address ranges or non-public hostnames.
Repeated requests to the pretty-URL handler with varying Host header values, indicative of internal network scanning.

Detection Strategies

Inspect web server and reverse proxy access logs for requests to /uploads/attachments/<cuid>-<slug>.<ext> paths where the Host header deviates from the expected public hostname.
Monitor egress network telemetry from application servers running ApostropheCMS for unexpected destinations on private network ranges.
Correlate timing anomalies in response latency on the pretty-URL endpoint, which may indicate the server is reaching out to unreachable internal hosts.

Monitoring Recommendations

Enable detailed logging of the Host header on all requests to the @apostrophecms/file pretty-URL routes.
Configure egress firewall rules to log and alert on outbound HTTP traffic originating from the Apostrophe process to internal subnets.
Track the rate of 404 and 502 responses on the pretty-URL endpoint, as elevated rates may indicate SSRF probing activity.

How to Mitigate CVE-2026-53607

Immediate Actions Required

Disable the prettyUrls feature on @apostrophecms/file by setting prettyUrls: false until a patched version is released.
Place ApostropheCMS behind a reverse proxy that enforces a strict Host header allowlist and rejects requests with unexpected values.
Restrict outbound network access from the Apostrophe process using egress firewall rules that block connections to internal subnets and metadata services.

Patch Information

As of the publication of CVE-2026-53607, no patched versions of ApostropheCMS exist. Monitor the ApostropheCMS GitHub Security Advisory GHSA-34pj-2622-jvxq for updates and apply patches as soon as they become available.

Workarounds

Configure the reverse proxy (such as nginx or HAProxy) to normalize or overwrite the Host header to a fixed canonical value before forwarding requests to the Apostrophe backend.
Apply network segmentation so the Apostrophe Node.js process can only reach explicitly required external destinations, blocking access to internal management interfaces and cloud metadata endpoints.
Deploy a web application firewall rule that rejects requests containing Host header values matching private IP ranges or non-allowlisted hostnames.

bash

# Example nginx configuration to enforce a fixed Host header upstream
server {
    listen 443 ssl;
    server_name www.example.com;

    location / {
        proxy_pass http://apostrophe_backend;
        proxy_set_header Host www.example.com;
        proxy_set_header X-Forwarded-Host $host;
    }
}