ApostropheCMS: Path traversal in uploadfs
影響: npm:uploadfs < 1.28.0 → 1.28.0
The uploadfs library's local storage backend does not validate or sanitize user-supplied paths. The prefixPath() helper only strips double slashes (//) and the backend performs direct string concatenation (uploadsPath + path). An attacker can inject ../ sequences to escape the intended uploads directory, resulting in arbitrary file read, write, and delete on the host filesystem. --- Details Root Cause packages/uploadfs/uploadfs.js:652-655 https://github.com/apostrophecms/apostrophe/blob…
Read on GitHub Advisory Database
| CVE | CVE-2026-113651 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/22/2026, 01:17 AM |
| Data | Markdown JSON |
On 10/21/2026, 03:21 AM, GitHub Advisory Database published "ApostropheCMS: Path traversal in uploadfs" (type: Advisory). Severity is "Low" (low). Related technologies: JavaScript / Node.js, GitHub. CVE: CVE-2026-113651.