{"id":"ghsa-ghsa-gmfx-5g6x-rr72","seq":2409,"kind":"advisory","title":"ApostropheCMS: Path traversal in uploadfs","url":"https://github.com/advisories/GHSA-gmfx-5g6x-rr72","permalink":"https://vulnpulse.app/items/ghsa-ghsa-gmfx-5g6x-rr72","summary":"影響: npm:uploadfs < 1.28.0 → 1.28.0\nSummary The uploadfs library's local storage backend does not validate or sanitize user-supplied paths. The prefixPath() helper only strips double slashes (//) and the backend performs direct string concatenation (uploadsPath + path). An attacker can inject ../ sequences to escape the intended uploads directory, resulting in arbitrary file read, write, and delete on the host filesystem. --- Details Root Cause packages/uploadfs/uploadfs.js:652-655 https://github.com/apostrophecms/apostrophe/blob…","severity":"low","techs":["nodejs","github"],"cves":["CVE-2026-113651"],"tags":["GHSA-gmfx-5g6x-rr72","uploadfs"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:21:59.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}