@apostrophecms/ai-helper CVE-2026-113671

Exploitation requires three conditions stated in the advisory: (1) a low-privileged authenticated editor account holding image-generation capability, used to create a base64 AI image record persisted without a stored provider 'url'; (2) the deployment must use local relative storage (default uploadfs, e.g. '/uploads') AND have no configured global base URL (apos.baseUrl unset - the default), so req.baseUrl falls back to the Host header; and (3) a PATCH accept request on the ai-helper/:_id route carrying an attacker-crafted Host header, which that route processes without any authorization or ownership check. Limiting factors: the SSRF is bounded - the attacker controls target host, port, and HTTP origin but not the request path (fixed uploads path), and the flaw does NOT affect stored-provider configurations or deployments using absolute storage or a configured trusted global base URL. An editor-level account is a hard prerequisite.

This is a genuine but modest-severity (CVSS 4.3) authenticated SSRF (CWE-918) confirmed by the vendor GHSA-527g-ff96-x6wj advisory and fixed source commits. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) aligns well with the description: network-reachable, low complexity, but requiring a low-privileged authenticated editor account with image-generation capability, with only low confidentiality impact and no integrity or availability impact. No EPSS score was provided and the CVE is not in CISA KEV, indicating no evidence of active exploitation. No public exploit code was identified in the provided data, though the GHSA advisory documents the root cause and attack mechanics in detail, lowering the barrier to weaponization. The signals are internally consistent - this is not a high-CVSS-but-low-real-risk mislabel, rather a correctly rated medium/low issue whose real-world risk is constrained by the editor-account prerequisite and by the SSRF being bounded (attacker controls host/port/origin but not arbitrary path, and stored-provider/absolute-storage configs are unaffected). Priority is moderate: patch in affected deployments, but it is not an emergency relative to unauthenticated RCE-class issues.

An attacker who has obtained a low-privileged editor account on an ApostropheCMS site (using the default local relative storage with no configured global base URL) generates a base64 AI image, which is persisted without a stored provider URL, then sends an unauthorized PATCH accept request carrying a crafted Host header. The server resolves the fixed uploads path against the attacker-controlled Host-derived origin and issues an outbound GET to an attacker-selected internal host and port, letting the attacker probe internal network services unreachable from their own network. No public exploit code was identified, but the vendor advisory describes the technique in detail.