ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL the default, req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can...

GHSA-527G-FF96-X6WJ ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL the default, req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

CVE-2026-113671

In ApostropheCMS , a vulnerability exists in the @apostrophecms/ai-helper component (versions 1.0.0-beta.10 through 1.0.0-beta.13 ). An authenticated editor with image-generation capabilities can create a base64-generated image record without a provider URL. On deployments using local relative st...

Docling: Configured HTTP headers sent to every remote image host named by a document

SummaryHTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled ima...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

EUVD-2026-82683

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

EUVD-2026-80792

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380

WuzhiCMS up to 4.1.0 is affected by a server-side request forgery (SSRF) vulnerability in the Remote Image Fetch component. The flaw resides in the function ckditor::saveRemote within coreframe/app/attachment/index.php , where manipulation of the source[] argument allows an unauthenticated, remot...

CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380: Server-Side Request Forgery (SSRF)

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

PT-2026-93807

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1 Description A server-side request forgery SSRF exists in the Remote Image Fetch component. This occurs when the ckditor::saveRemote function in the coreframe/app/attachment/index.php file improperly handles the...

CVE-2026-49865

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

CVE-2026-49865

Kimai , an open-source time tracking application, versions prior to 2.58.0 are affected by a Server-Side Request Forgery (SSRF) in the invoice PDF preview and generation workflow. The root cause is that user-controlled Markdown fields (e.g., Customer.invoiceText) pass through an md2html filter in...

EUVD-2026-76765

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later rendered into an invoice PDF, such as Customer.invoiceTex...

Server-side Request Forgery (SSRF)

Overview @platejs/docx-io is a DOCX import/export for Plate - file-based document conversion Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildImage and buildParagraph functions in render-document-file.ts and xml-builder.ts, which unconditionally...