CVE-2026-113651

LowCVSS 3.3

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

In uploadfs prior to 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted paths.

Risk Assessment

An attacker may read, overwrite, or delete files outside the upload directory on the host, potentially leading to data disclosure or application damage. Risk depends on exposure of uploadfs operations to untrusted paths.

Recommendation

Upgrade uploadfs to version 1.28.0 or later. Ensure uploadfs operations do not accept untrusted paths from users.

Other vulnerabilities in uploadfs

CVE-2026-113652Medium
From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string.

Original NVD description (English source)

ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS