apostrophecms uploadfs vulnerabilities

Latest apostrophecms uploadfs CVEs

Newest publication first

1. CVE-2026-113652 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

   Published 2026-10-20

   Medium·CVSS 5.6 EPSS 0.28%

   ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobS...

2. CVE-2026-113651 ApostropheCMS: Path traversal in uploadfs

   Published 2026-10-20

   Low·CVSS 3.3 EPSS 0.33%

   ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.