{"id":"CVE-2026-113651","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-113651","generatedAt":"2026-10-28T10:47:55.589Z","title":"Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem.","description":"ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.","published":"2026-10-20T17:17:36.000Z","lastModified":"2026-10-20T19:53:10.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":3.3,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-22"],"affected":[],"epss":{"score":0.00328,"percentile":0.25771,"date":"2026-10-27","history":[{"date":"2026-10-21","score":0.00328,"percentile":0.24607}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-20T17:17:36.000Z","detail":{"score":"3.3","severity":"LOW","publishedAt":"2026-10-20T17:17:35.940Z"},"summary":"New CVE, low severity (CVSS 3.3)."}],"references":[{"url":"https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72","source":"security-advisories@github.com"},{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-113651","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}