ApostropheCMS versions up to 4.29.0 are vulnerable to an authenticated SSRF in the rich‑text widget import flow. An authenticated user capable of submitting or editing widget content can trigger the server to fetch an attacker‑controlled URL during validation. If the response is image‑compatible, the fetched content is persisted and re‑hosted by the CMS, allowing an attacker to exfiltrate data. This flaw is identified by CWE‑918.

The vulnerability affects ApostropheCMS, specifically all releases up through version 4.29.0. Any deployment of these versions that enables rich‑text widget imports is potentially exposed.

The CVSS score of 7.6 indicates moderate to high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely but possible. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an authenticated web user who can add or modify rich‑text widgets; the attacker can supply a malicious URL that the server requests, and if the content is image‑compatible, the CMS will store and serve it, effectively leaking data to the attacker.