CVE-2026-53607 @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
Unauthenticated attackers can exploit SSRF in ApostropheCMS file plugin when pretty URLs are enabled, enabling internal network mapping and potential data leakage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53607?
CVE-2026-53607 is a low-severity server-side request forgery vulnerability in apostrophecms apostrophe, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header. That URL is then `fetch`'ed and the response body + headers are streamed straight back to the requester. Because `Host` is fully attacker-controlled, an unauthenticated remote attacker can pivot the apostrophe process to issue outbound HTTP requests against any host it can reach on the private network. The path component is constrained to `/uploads/attachments/<cuid>-<slug>.<ext>` (built from a local-DB lookup), which keeps the impact narrow: cross-instance data exfiltration is neutralized by cuid uniqueness, but blind-SSRF residuals remain (network-topology mapping via response-code / timing differences and verbose proxy/WAF 404 body disclosure). As of time of publication, no known patched versions exist.
Weakness: CWE-918
Which versions are affected by CVE-2026-53607?
2 open source packages ship an affected version, including apostrophe.
| Package | Affected | Fixed in |
|---|---|---|
apostrophe npm | All versions | 4.31.0 |
apostrophe npm | All versions | 4.31.0 |
How do I fix CVE-2026-53607?
Upgrade apostrophe to 4.31.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-53607 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53607 exists.
Sources
Also known as GHSA-34pj-2622-jvxq.