CVE-2026-113651: ApostropheCMS: Path traversal in uploadfs
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uploadfsto a version that resolves this vulnerability.Fixed in 1.28.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using uploadfs before 1.28.0 are potentially affected when they use the local storage backend and expose uploadfs operations that accept untrusted paths. Applications that do not allow untrusted input to reach those operations are not described as exploitable.
What must an attacker be able to do to exploit it?
An attacker needs to control a path that reaches relevant uploadfs operations on the local backend. The path must be able to include parent-directory segments, allowing it to escape the configured upload directory for file reads, writes, or deletion.
Is a default installation necessarily vulnerable?
No. Exploitability depends on the application's configuration and whether it exposes the relevant uploadfs operations to untrusted path input, rather than solely on the installed package version.
What is the available remediation?
Upgrade uploadfs to version 1.28.0. If upgrading cannot happen immediately, prevent untrusted users from supplying paths to uploadfs operations that use the local backend.