THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-34pj-2622-jvxq (low) — @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

[GHSA] GHSA-34pj-2622-jvxq (low) — @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

highgithub_advisoriesPublished 2026-07-31

GHSA-34pj-2622-jvxq Severity: low CVE: CVE-2026-53607

@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

### Summary

When `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header:

```js proxyUrl = `${req

Indicators of compromise

CVE-2026-53607cve
http://internal/url
http://127.0.0.1:3000/files/poc.pdfurl

Original source: https://github.com/advisories/GHSA-34pj-2622-jvxq