DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-53607: CVE-2026-53607: Server-Side Request Forgery in ApostropheCMS via Host Header Manipulation

#security #cve #cybersecurity

CVE-2026-53607: Server-Side Request Forgery in ApostropheCMS via Host Header Manipulation

Vulnerability ID: CVE-2026-53607
CVSS Score: 3.7
Published: 2026-07-31

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in ApostropheCMS versions up to and including 4.30.0. When the prettyUrls option is enabled in the @apostrophecms/file module, the server constructs internal self-requests using the client-provided HTTP Host header, allowing remote attackers to coerce the server into initiating outbound requests to arbitrary internal or external hosts.

TL;DR

Unauthenticated remote attackers can exploit a Host header injection flaw in ApostropheCMS to perform Server-Side Request Forgery (SSRF), mapping internal networks and scanning ports behind firewalls.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network (AV:N)
  • CVSS Score: 3.7
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed
  • EPSS Score: 0.00226

Affected Systems

  • ApostropheCMS <= 4.30.0
  • apostrophe: <= 4.30.0 (Fixed in: 4.31.0)

Code Analysis

Commit: 5a88e96

Fix pretty URL route proxying SSRF vulnerability

Exploit Details

Mitigation Strategies

  • Disable the prettyUrls configuration in the @apostrophecms/file module options.
  • Define a strict, trusted static baseUrl configuration within ApostropheCMS to prevent reliance on the HTTP Host header.
  • Implement outbound network firewall rules (egress filtering) to prevent the application server from connecting to loopback, private ranges, or link-local endpoints such as 169.254.169.254.

Remediation Steps:

  1. Upgrade ApostropheCMS package dependencies to version 4.31.0 or later.
  2. Ensure that modules/@apostrophecms/file/index.js does not parse req.get('host') inside file routing proxy handlers.
  3. Configure your web proxy or gateway (such as Nginx or AWS Application Load Balancer) to drop requests with non-conforming Host headers.

References

Read the full report for CVE-2026-53607 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)