{"id":"EUVD-2026-36568","enisaUuid":"a1b2aebd-5fec-35c1-b00e-f44e7f7c7128","description":"ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:44:48 PM","dateUpdated":"Jun 15, 2026, 7:27:52 PM","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6\n","aliases":"CVE-2026-45012\nGHSA-pr28-mf3q-qpg6\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"981f420d-433f-3825-b108-17e937586c22","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"≤ 4.29.0"}],"enisaIdVendor":[{"id":"0728e92f-aff3-331c-804a-65a51de042e9","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"8ce14f79-1744-3951-b553-8abe2f1c3445","vulnerability":{"id":"CVE-2026-45012","description":"ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. As of time of publication, no known patched versions are available.","datePublished":"Jun 12, 2026, 8:44:48 PM","dateUpdated":"Jun 15, 2026, 7:27:52 PM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6\n","enisa_id":"EUVD-2026-36568\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Oct 28, 2026, 7:17:09 AM","vulnerabilityProduct":[{"id":"c4b64782-97c9-3a41-8724-87e9b7aab90a","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"≤ 4.29.0"}],"vulnerabilityVendor":[{"id":"373f853c-b0cc-3cb4-8bfc-99180836b99b","vendor":{"name":"apostrophecms"}}]}},{"id":"aba99090-83e1-3dd4-aa0d-0f4a477f758f","vulnerability":{"id":"GHSA-pr28-mf3q-qpg6","description":"Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget","datePublished":"May 14, 2026, 6:26:45 PM","dateUpdated":"Jun 12, 2026, 10:02:09 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45012\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-36568\n","aliases":"GHSA-pr28-mf3q-qpg6\nCVE-2026-45012\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}