Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Description

ApostropheCMS contains an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.29.0

References

• GHSA-pr28-mf3q-qpg6
• CVE-2026-45012
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Payload has Authenticated SSRF via Upload Functionality - CVE-2026-34746
• Apostrophe has stored XSS via javascript: URL in Image Widget Link - CVE-2026-45011
• Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
• i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters - CVE-2026-42353

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

apostrophe