CVE-2026-113651
CVE-2026-113651 · ApostropheCMS: Path traversal in uploadfs
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
CVSS 3.3 · Faible · EPSS 0,3% · Code d’exploitation public · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
apostrophe
- Versions du logiciel
- < 4.33.0: Concernée
Aucun correctif publié
uploadfs
- Versions du logiciel
- < 1.28.0: Concernée
Aucun correctif publié
uploadfs npm
- Plages de versions concernées
- SEMVER: < 1.28.0
Mettez à jour vers 1.28.0
Sources originales
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-113651