Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M
CVE-2026-113651ApostropheCMS: Path traversal in uploadfs
Low 3.3
In plain English
A low-severity path traversal in apostrophe from apostrophecms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | uploadfs | 1.28.0 | GHSA-gmfx-5g6x-rr72 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| apostrophecms | apostrophe | < 4.33.0 |
| apostrophecms | uploadfs | < 1.28.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72 x_refsource_CONFIRM
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce x_refsource_MISC
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350 x_refsource_MISC
- https://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0 x_refsource_MISC