Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Description

ApostropheCMS contains an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.29.0

References

• GHSA-pr28-mf3q-qpg6
• CVE-2026-45012
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Apostrophe has stored XSS via javascript: URL in Image Widget Link - CVE-2026-45011
• Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
• Payload has Authenticated SSRF via Upload Functionality - CVE-2026-34746
• ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction - CVE-2026-32731

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

apostrophe