4.3
Moyenne
CVE-2026-113671 ApostropheCMS is an open-source Node.js content management system
Description
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or the stored-provider and absolute-storage configurations. This issue is fixed in AI helper 1.0.0-beta.13.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| apostrophe 4.25 | 4.25.0 → < 4.33.0 | 4.33.0 |
| ai-helper 1.0 | 1.0.0-beta.10 → < 1.0.0-beta.13 | 1.0.0-beta.13 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de apostrophe
Les 51 CVE de apostrophe →
CVE-2026-113711
ApostropheCMS is an open-source Node.js content management system
7.5
Élevée
CVE-2026-113710
ApostropheCMS is an open-source Node.js content management system
5.9
Moyenne
CVE-2026-113670
ApostropheCMS is an open-source Node.js content management system
5.3
Moyenne
CVE-2026-113669
ApostropheCMS is an open-source Node.js content management system
5.3
Moyenne