LOW 3.7 GitHub
CVE-2026-53607
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
### Summary
When `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO
feature for serving uploaded files at clean URLs), the public pretty-URL
handler builds the upstream URL using the raw `Host` HTTP request header:
```js
proxyUrl = `${req.protocol}://${req.get('host')}${uglyUrl}`
```
That URL is then `fetch`'ed and the response body + headers are streamed
straight back to the requester. Because `Host` is fully attacker-controlled,
an **unauthenticated remote** attacker c
Affected Products
- npm/apostrophe <= 4.30.0
References
- https://github.com/advisories/GHSA-34pj-2622-jvxq
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-34pj-2622-jvxq
- https://nvd.nist.gov/vuln/detail/CVE-2026-53607
- https://github.com/apostrophecms/apostrophe/pull/5464
This low severity vulnerability with a CVSS score of 3.7 was published on 2026-07-31 via GitHub. Affected: npm/apostrophe <= 4.30.0.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.