CVE-2026-45012: Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

May 14, 2026 (updated June 12, 2026)

ApostropheCMS contains an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration.

References

github.com/advisories/GHSA-pr28-mf3q-qpg6
github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6
nvd.nist.gov/vuln/detail/CVE-2026-45012

Code Behaviors & Features

Detect and mitigate CVE-2026-45012 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →