CVE-2026-53607 is a Server-Side Request Forgery (SSRF) vulnerability in ApostropheCMS (Node.js CMS) versions up to and including 4.30.0. When the 'prettyUrls: true' option is enabled on the '@apostrophecms/file' module, the public pretty-URL handler constructs an upstream URL using the raw Host HTTP request header without validation. This URL is then fetched by the server, and the response is streamed back to the client. Because the Host header is attacker-controlled, an unauthenticated remote attacker can cause the server to make HTTP requests to arbitrary hosts accessible from the server's network. The path component is restricted to a pattern based on a local database lookup, limiting the ability to exfiltrate data across instances. However, blind SSRF remains possible, enabling network topology reconnaissance through response codes, timing differences, and verbose error messages from proxies or WAFs. As of the publication date, no patched versions or official fixes are available.

An unauthenticated attacker can leverage this SSRF vulnerability to make the ApostropheCMS server issue HTTP requests to internal or otherwise inaccessible hosts within the server's network. While direct data exfiltration is mitigated by path constraints and unique identifiers, the attacker can perform network reconnaissance and fingerprint internal services via response timing and error message analysis. The confidentiality impact is low, with no integrity or availability impact reported.

As of the current information, no official patch or fix is available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider disabling the 'prettyUrls' feature on '@apostrophecms/file' or restricting access to the vulnerable endpoint to trusted users or networks to reduce exposure. Avoid relying on the Host header for constructing upstream URLs or implement strict validation and sanitization of this header.