{"id":"EUVD-2026-36576","enisaUuid":"ee0c3039-1ac8-30ff-b624-824b4cf072af","description":"ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header. That URL is then `fetch`\u0027ed and the response body + headers are streamed straight back to the requester. Because `Host` is fully attacker-controlled, an unauthenticated remote attacker can pivot the apostrophe process to issue outbound HTTP requests against any host it can reach on the private network. The path component is constrained to `/uploads/attachments/\u003ccuid\u003e-\u003cslug\u003e.\u003cext\u003e` (built from a local-DB lookup), which keeps the impact narrow: cross-instance data exfiltration is neutralized by cuid uniqueness, but blind-SSRF residuals remain (network-topology mapping via response-code / timing differences and verbose proxy/WAF 404 body disclosure). As of time of publication, no known patched versions exist.","datePublished":"Jun 12, 2026, 8:54:30 PM","dateUpdated":"Jun 15, 2026, 6:35:34 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-34pj-2622-jvxq\n","aliases":"CVE-2026-53607\nGHSA-34pj-2622-jvxq\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"636648f9-b077-3809-be75-921f4c68f2c7","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"≤ 4.30.0"}],"enisaIdVendor":[{"id":"6ccb4b1c-7612-3c0c-b97c-c4d99c6bb2e9","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"d16a7991-fb60-3798-8f46-c8f846f89d39","vulnerability":{"id":"CVE-2026-53607","description":"ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header. That URL is then `fetch`\u0027ed and the response body + headers are streamed straight back to the requester. Because `Host` is fully attacker-controlled, an unauthenticated remote attacker can pivot the apostrophe process to issue outbound HTTP requests against any host it can reach on the private network. The path component is constrained to `/uploads/attachments/\u003ccuid\u003e-\u003cslug\u003e.\u003cext\u003e` (built from a local-DB lookup), which keeps the impact narrow: cross-instance data exfiltration is neutralized by cuid uniqueness, but blind-SSRF residuals remain (network-topology mapping via response-code / timing differences and verbose proxy/WAF 404 body disclosure). As of time of publication, no known patched versions exist.","datePublished":"Jun 12, 2026, 8:54:30 PM","dateUpdated":"Jun 15, 2026, 6:35:34 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-34pj-2622-jvxq\n","enisa_id":"EUVD-2026-36576\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"80ddafc7-47f1-35a2-b97b-bc89dbb176c8","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"≤ 4.30.0"}],"vulnerabilityVendor":[{"id":"baab8e0b-026d-3404-a23b-0364a726be99","vendor":{"name":"apostrophecms"}}]}},{"id":"e3b27b4b-3ea6-318f-9674-cba3b9fcef52","vulnerability":{"id":"GHSA-34pj-2622-jvxq","description":"@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header","datePublished":"Jul 31, 2026, 9:51:41 PM","dateUpdated":"Jul 31, 2026, 9:51:41 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-34pj-2622-jvxq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53607\nhttps://github.com/apostrophecms/apostrophe/pull/5464\nhttps://github.com/apostrophecms/apostrophe/commit/5a88e9630cbbdde33154ef8abe7557ddf7be418b\nhttps://github.com/apostrophecms/apostrophe\n","enisa_id":"EUVD-2026-36576\n","aliases":"GHSA-34pj-2622-jvxq\nCVE-2026-53607\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}