CVE-2026-45012
published 2026-06-12CVE-2026-45012: ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery…
PriorityP347high7.6CVSS 3.1
AVNACLPRLUINSUCHILAL
EPSS
0.20%
9.7th percentile
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. As of time of publication, no known patched versions are available.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apostrophecms | apostrophe | <= 4.29.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
apostrophecms apostrophe up to 4.29.0 server-side request forgery (GHSA-pr28-mf3q-qpg6)
vuldb·2026-06-13·CVSS 7.6
CVE-2026-45012 [HIGH] apostrophecms apostrophe up to 4.29.0 server-side request forgery (GHSA-pr28-mf3q-qpg6)
A vulnerability was found in apostrophecms apostrophe up to 4.29.0. It has been classified as critical. Affected is an unknown function. Performing a manipulation results in server-side request forgery.
This vulnerability is cataloged as CVE-2026-45012. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
ghsa·2026-05-14
CVE-2026-45012 [HIGH] CWE-918 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
### Summary
ApostropheCMS contains an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration.
### Details
The vulnerable flow is in the rich-text widget sanitizer:
- `packages/apostrophe/modules/@apostrophecms/rich-text-widget/index.js`
- `packages/apostrophe/modules/@apostrophecms/area/index.js`
- `packages/apostrophe/modules/@apostrophecms/widget-type/index.js`
Relevant behavior:
1.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-12
Published