CVE-2026-113651 ApostropheCMS: Path traversal in uploadfs
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-113651?
CVE-2026-113651 is a low-severity vulnerability in apostrophecms apostrophe, published on 20 Oct 2026.
Official description
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-113651?
2 open source packages ship an affected version, including uploadfs.
| Package | Affected | Fixed in |
|---|---|---|
uploadfs npm | All versions | 1.28.0 |
uploadfs npm | All versions | 1.28.0 |
How do I fix CVE-2026-113651?
Upgrade uploadfs to 1.28.0 or later.
Is CVE-2026-113651 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113651 exists.
Sources
Also known as GHSA-gmfx-5g6x-rr72.