{"items":[{"id":"NVI-00018272","kind":"vulnerability","title":"Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pr28-mf3q-qpg6","CVE-2026-45012"],"plain_summary":"GitHub lists this reviewed advisory for apostrophe. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0446df630b7ee70ab5ee94effc97d728"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-12T22:02:10.000Z","value":"7.6 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0446df630b7ee70ab5ee94effc97d728"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0446df630b7ee70ab5ee94effc97d728","url":"https://github.com/advisories/GHSA-pr28-mf3q-qpg6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pr28-mf3q-qpg6","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T15:12:54.193Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0446df630b7ee70ab5ee94effc97d728"],"technology":"apostrophe","known_exclusions":[],"conditions_summary":"### Summary\nApostropheCMS contains an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration.\n\n### Details\n  The vulnerable flow is in the rich-text widget sanitizer:\n  - `packages/apostrophe/modules/@apostrophecms/rich-text-widget/index.js`\n  - `packages/apostrophe/modules/@apostrophecms/area/index.js`\n  - `packages/apostrophe/modules/@apostrophecms/widget-type/index.js`\n\nRelevant behavior:\n  1. The backend accepts a widget payload containing `import.html`.\n  2. It parses `` values from that HTML.\n  3. For each image, it resolves the URL with:\n     - `new URL(src, input.import.baseUrl || self.apos.baseUrl)`\n  4. It then performs a server-side `fetch(url)`.\n  5. The fetched body is written to a temp file and imported through Apostrophe image/attachment logic.\n\n  This is reachable during widget validation through:\n  - `POST /api/v1/@apostrophecms/area/validate-widget?","public_affected_ranges":["<= 4.29.0"]}],"null_published_at":"2026-11-07T07:07:39.798Z","source_updated_at":"2026-06-12T22:02:10.000Z","source_disclosed_at":"2026-05-14T18:26:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T15:12:54.193Z"}],"next_cursor":null,"snapshot_revision":"42594"}