CVE-2026-113651

3.3 LOWpublic exploit available

Published 2026-10-20 · Updated 2026-10-20

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CWE-22

Public exploit & PoC references

https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72

All references

https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2012-20002PoC
HIGHCVE-2014-125130PoC
HIGHCVE-2014-125133PoC
HIGHCVE-2014-125134PoC
HIGHCVE-2015-20123PoC
HIGHCVE-2015-20124PoC
HIGHCVE-2015-20125PoC
HIGHCVE-2016-20100PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.