CVE-2026-113651
ApostropheCMS: Path traversal in uploadfs
- State
- Published
- Severity
- 3.3 Low
- Published
- Oct 20, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 20, 2026
Description
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.3 Low | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N | GitHub_M |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
apostropheapostrophecms |
|
uploadfsapostrophecms |
|
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.