CVE-2026-113671: CWE-918: Server-Side Request Forgery (SSRF) in apostrophecms apostrophe

ApostropheCMS, an open-source Node.js CMS, has an SSRF vulnerability in versions >=4.25.0 <4.33.0 and its AI helper component versions >=1.0.0-beta.10 <1.0.0-beta.13. An editor with image-generation capability can create a base64-generated image record without a stored provider URL and trigger image acceptance on deployments using local relative storage without a trusted global base URL. This causes the server to resolve the fixed uploads path against a Host-derived origin controlled by the request, enabling bounded SSRF to attacker-selected hosts, ports, and HTTP origins. Arbitrary path retrieval or stored-provider and absolute-storage configurations are not affected. The vulnerability is addressed in AI helper 1.0.0-beta.13.

The vulnerability allows an attacker with editor privileges and image-generation capability to induce the server to make HTTP requests to attacker-chosen hosts and ports within certain bounds. This could potentially be used to interact with internal network services or other unintended targets. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact reported. No known exploits in the wild have been reported.

Upgrade the AI helper component to version 1.0.0-beta.13 or later, which contains the fix for this SSRF vulnerability. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on applying this update in affected deployments.