Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

EPSS

• CVE-2026-45012: 0.24% estimated exploitation activity in the next 30 days; percentile 14.49 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary ApostropheCMS contains an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. Details The vulnerable flow is in the rich-text widget sanitizer: - packages/apostrophe/modules/@apostrophecms/rich-text-widget/index.js - packages/apostrophe/modules/@apostrophecms/area/index.js - packages/apostrophe/modules/@apostrophecms/widget-type/index.js Relevant behavior: 1. The backend accepts a widget payload containing import.html. 2. It parses <img src=... values from that HTML. 3. For each image, it resolves the URL with: - new URL(src, input.import.baseUrl || self.apos.baseUrl) 4. It then performs a server-side fetch(url). 5. The fetched body is written to a temp file and…

Published by the source

14 May 2026, 18:26 UTC

Last modified by the source

12 Jun 2026, 22:15 UTC

Source last checked

26 Oct 2026, 12:55 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-pr28-mf3q-qpg6

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-pr28-mf3q-qpg6

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-45012

Advisory: Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
IDs: CVE-2026-45012, GHSA-pr28-mf3q-qpg6
Record: https://patchnext.com/advisories/cve-2026-45012 (revision 2, source checked 26 Oct 2026, 12:55 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm apostrophe: affected <= 4.29.0

## Suggested inspection (read-only)
- `npm ls apostrophe --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on apostrophe.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-pr28-mf3q-qpg6 (OSV record GHSA-pr28-mf3q-qpg6 lists affected ranges: npm apostrophe >=0 <=4.29.0)
- Verified: https://github.com/advisories/GHSA-pr28-mf3q-qpg6 (GitHub-reviewed advisory GHSA-pr28-mf3q-qpg6 lists affected ranges: npm apostrophe >=0 <=4.29.0)

Commands are suggestions: review each one before running it.