Prototype Chain Traversal Vulnerability in ApostropheCMS by Apostrophe
CVE-2026-113666

7.1HIGH

Key Information:

Vendor: Apostrophecms
Status: Apostrophe; Db-connect
Vendor: CVE Published:; 20 October 2026

🔔 Create Apostrophecms Vulnerability Alert

What is CVE-2026-113666?

ApostropheCMS, an open-source Node.js content management system, is susceptible to a prototype chain traversal vulnerability. This issue allows an account with view-draft permissions to submit a projection exclusion path. When using SQLite, PostgreSQL, or multipostgres adapters, it can lead to the deletion of a shared runtime member, impacting both system integrity and availability. The default MongoDB adapter is unaffected. This vulnerability has been resolved in the recent versions: db-connect 1.1.0 and ApostropheCMS 4.33.0.