CVE-2026-45012

{
  "id": "CVE-2026-45012",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T21:16:22.720",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content can be persisted and re-hosted by Apostrophe, allowing response exfiltration. As of time of publication, no known patched versions are available."
    },
    {
      "lang": "es",
      "value": "ApostropheCMS es un sistema de gestión de contenido de código abierto basado en Node.js. Las versiones hasta la 4.29.0 inclusive contienen una falsificación de petición del lado del servidor (SSRF) autenticada en el flujo de importación del widget de texto enriquecido. Un usuario autenticado que puede enviar/editar contenido del widget de texto enriquecido puede hacer que el servidor obtenga URL controladas por el atacante durante la validación del widget. Para respuestas compatibles con imágenes, el contenido obtenido puede ser persistido y re-alojado por Apostrophe, permitiendo la exfiltración de la respuesta. Al momento de la publicación, no hay versiones parcheadas conocidas disponibles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "apostrophecms",
          "product": "apostrophe",
          "versions": [
            {
              "version": "<= 4.29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T18:47:58.858311Z",
          "id": "CVE-2026-45012",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-pr28-mf3q-qpg6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}