3.3
Low
CVE-2026-113651 ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library
Description
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| apostrophe 4.33 | earliest → < 4.33.0 | 4.33.0 |
| uploadfs 1.28 | earliest → < 1.28.0 | 1.28.0 |
Other CVEs of apostrophe
The 51 CVEs of apostrophe →
CVE-2026-113711
ApostropheCMS is an open-source Node.js content management system
7.5
High
CVE-2026-113710
ApostropheCMS is an open-source Node.js content management system
5.9
Medium
CVE-2026-113671
ApostropheCMS is an open-source Node.js content management system
4.3
Medium
CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system
5.3
Medium