EUVD-2026-36576

@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header...

CVE-2026-53607: Server-Side Request Forgery (SSRF)

ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when prettyUrls: true is enabled on @apostrophecms/file a documented SEO feature for serving uploaded files at clean URLs, the public pretty-URL handler builds the upstream URL using the raw...