CVE-2026-45012: Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

Synopsis

An authenticated server-side request forgery (SSRF) vulnerability exists in ApostropheCMS versions up to and including 4.29.0, affecting the rich-text widget import flow via the @apostrophecms/area/validate-widget endpoint. An attacker with any valid login capable of editing rich-text widget content can force the server to issue HTTP requests to attacker-controlled URLs during widget validation. Successful exploitation allows the attacker to read internal network resources, exfiltrate those responses through Apostrophe's own media hosting, and cause limited data tampering and service degradation. No patched version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the ApostropheCMS service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account with permission to create or edit rich-text widget content is sufficient to trigger the SSRF; no admin access is needed.

• Victim interactionNot required

  No victim action is required; the attacker submits the malicious widget payload directly to the server.

• Attack complexityDetail

  Exploitation is reliable and condition-free: submitting a crafted URL in the widget import payload is sufficient with no race conditions or special environmental setup needed.

Blast Radius

• The server issues outbound HTTP requests to attacker-controlled or internal URLs, exposing internal services, cloud metadata endpoints (such as AWS IMDSv1), and other resources unreachable from outside the network.
• For image-compatible responses, the fetched content is persisted and re-hosted by Apostrophe, giving the attacker a durable copy of exfiltrated internal data accessible via the CMS media layer.
• The attacker can write limited data through the persistence mechanism, modifying what Apostrophe stores and serves as media assets.
• Repeated or large-payload SSRF requests can degrade server responsiveness, causing partial availability loss for the affected CMS instance.