CVE-2026-113671

## Summary The `@apostrophecms/ai-helper` package builds the URL for a server-side image fetch by resolving a storage-relative path against `req.baseUrl`. When the site does not set a global base URL (the default), `req.baseUrl` is derived from the incoming HTTP `Host` header. An authenticated editor can generate a base64 AI image (which is persisted without a stored `url`) and then send an unauthorized `PATCH` accept request with an attacker-chosen `Host` header. The server then issues an outbound `GET` to the attacker-selected origin, producing a Server-Side Request Forgery primitive that reaches hosts and ports the client cannot otherwise contact. The affected code lives in `packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js`. ## Root Cause The image accept route trusts `req.baseUrl` as a safe origin for constructing an internal fetch target, but `req.baseUrl` is attacker-influenced whenever the site has no configured base URL. The URL builder concatenates a default local storage path (which is relative, for example `/uploads`) and resolves it against `req.baseUrl`; because the left operand is relative, the resulting origin is taken entirely from `req.baseUrl`. Two protections that exist elsewhere are missing on this path: the generate route enforces an edit capability, but the accept route performs no authorization or ownership check, and no allowlist or validation constrains the resolved origin before the fetch. ```text packages/ai-helper/modules/@apostrophecms/ai-helper-image/index.js aiHelperImageUrl (line 91-92): image.url || new URL(self.uploadfs.getUrl() + `/ai-helper-images/${image._id}.png`, req.baseUrl) aiHelperFetchImage (line 64-65): fetch(self.aiHelperImageUrl(req, image)) apiRoutes.patch['ai-helper/:_id'] (line 314-333): findOne({ _id }) only; no permission or ownership check packages/apostrophe/modules/@apostrophecms/i18n/index.js setPrefixUrls (line 799-820): req.baseUrl falls back to `${req.protocol}://${host}`, host f