Directory Traversal Vulnerability in ApostropheCMS Uploadfs Library

CVE-2026-113651

What is CVE-2026-113651?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability in its Uploadfs file storage library that allows an attacker to manipulate paths to escape the configured upload directory. This can lead to unauthorized file access, modification, or deletion on the local filesystem. The vulnerability arises when the application exposes Uploadfs operations to untrusted input, allowing attackers to craft paths that include parent-directory segments. The issue has been resolved in Uploadfs version 1.28.0.

References