Approved changes feed: RSS · Atom
cpe:2.3:a:apostrophecms:uploadfs:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Apostrophecms (01c46484-782b-5ecd-aa32-4c843388532a) |
|---|---|
| Product | Uploadfs (f6a6079a-ab02-51e0-815d-570707c2bf4c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-113651 |
vulnerable | 2026-11-03 10:16:27.483991 |
ApostropheCMS: Path traversal in uploadfs
LOW (3.3)
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
Published: 2026-10-20T16:22:30.842Z
Updated: 2026-10-20T17:20:31.152Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-113652 |
vulnerable | 2026-11-03 10:16:27.155119 |
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
MEDIUM (5.6)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
Published: 2026-10-20T16:26:21.986Z
Updated: 2026-10-21T15:53:38.704Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.