LOW 3.3 NVD
CVE-2026-113651
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
References
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845c
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b35
- https://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72
This low severity vulnerability with a CVSS score of 3.3 was published on 2026-10-20 via NVD.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.