{"id":"CVE-2026-113671","summary":"ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF","details":"ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or the stored-provider and absolute-storage configurations. This issue is fixed in AI helper 1.0.0-beta.13.","aliases":["GHSA-527g-ff96-x6wj"],"modified":"2026-10-21T02:55:53.671347024Z","published":"2026-10-20T17:43:53.227Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113671.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113671.json"},{"type":"FIX","url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"type":"FIX","url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"},{"type":"WEB","url":"https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/ai-helper@1.0.0-beta.13"},{"type":"ADVISORY","url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-527g-ff96-x6wj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113671"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apostrophecms/apostrophe","events":[{"introduced":"b793817019a38c22fb8a73125c37ac07fbd47741"},{"fixed":"9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"introduced":"0"},{"fixed":"9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"},{"fixed":"f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"4.25.0"},{"fixed":"4.33.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StringRangeExpression","range":[{"introduced":"1.0.0-beta.10"},{"fixed":"1.0.0-beta.13"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["sanitize-html@2.17.7","apostrophe@4.32.1","@apostrophecms/apostrophe-astro@1.15.0","@apostrophecms/ai-helper@1.0.0-beta.12","uploadfs@1.27.0","sanitize-html@2.17.6","oembetter@1.2.1","create-apostrophe@1.1.0","@apostrophecms/vite@1.1.2","@apostrophecms/sitemap@1.5.0","@apostrophecms/seo@1.6.0","@apostrophecms/redirect@1.7.0","@apostrophecms/import-export@3.6.2","@apostrophecms/import-export-xlsx@1.1.0","@apostrophecms/form@1.5.4","@apostrophecms/apostrophe-astro@1.14.0","apostrophe@4.32.0","@apostrophecms/font-size@1.0.0","@apostrophecms/emulate-mongo-3-driver@1.0.7","sanitize-html@2.17.5","apostrophe@4.31.0","@apostrophecms/seo@1.5.0","@apostrophecms/redirect@1.6.0","@apostrophecms/import-export@3.6.1","@apostrophecms/cli@3.7.0","@apostrophecms/apostrophe-astro@1.13.0","apostrophe@4.30.0","sanitize-html@2.17.4","launder@1.7.1","@apostrophecms/cli@3.6.1","@apostrophecms/apostrophe-astro@1.12.0","sanitize-html@2.17.3","apostrophe@4.29.0","@apostrophecms/sitemap@1.4.0","@apostrophecms/seo@1.4.2","@apostrophecms/import-export@3.6.0","@apostrophecms/apostrophe-astro@1.11.0","uploadfs@1.26.1","sanitize-html@2.17.2","postcss-viewport-to-container-toggle@2.3.0","apostrophe@4.28.0","@apostrophecms/sitemap@1.3.0","@apostrophecms/seo@1.4.1","@apostrophecms/import-export@3.5.3","@apostrophecms/apostrophe-astro@1.10.0","sanitize-html@2.17.1","@apostrophecms/form@1.5.3","@apostrophecms/cli@3.6.0","@apostrophecms/apostrophe-astro@1.9.0","@apostrophecms/ai-helper@1.0.0-beta.11","postcss-viewport-to-container-toggle@2.2.0","apostrophecms-openapi@1.1.0","apostrophe@4.26.0","@apostrophecms/seo@1.4.0","@apostrophecms/openapi-generator@1.0.0","@apostrophecms/import-export@3.5.2","@apostrophecms/apostrophe-astro@1.8.0","apostrophe@4.25.0","@apostrophecms/login-totp@1.3.3","@apostrophecms/import-export@3.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113671.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}