CVE-2026-113651: ApostropheCMS uploadfs Path Traversal Vulnerability
Summary
CVE-2026-113651: ApostropheCMS: Path traversal in uploadfs. Affects uploadfs versions < 1.28.0. Fixed in 1.28.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications. It utilizes the uploadfs library for file uploads, which allows users to store files on the server. However, the library's local storage backend has a critical vulnerability that can be exploited to manipulate file paths, leading to unauthorized access to the filesystem.
Vulnerability Detail
The vulnerability arises from the uploadfs library's failure to properly validate or sanitize user-supplied paths. Specifically, the prefixPath() function only removes double slashes, while the local storage backend directly concatenates user input into filesystem calls. This allows attackers to use '..' sequences to traverse directories, potentially leading to arbitrary file read, write, and delete operations on the host filesystem. The implications of this vulnerability are severe, as it can lead to remote code execution, data exfiltration, and denial of service.
How To Fix
Latest published version: 1.28.1 as of 22 Oct 2026
npm install uploadfs@1.28.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.28.0
This is the first release that contains the fix.
npm install uploadfs@1.28.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the uploadfs library for file uploads until the package is updated. If you must use it, ensure that user input is strictly validated and sanitized before being passed to any filesystem operations.
Conclusion
The CVE-2026-113651 vulnerability in the ApostropheCMS uploadfs library poses significant risks due to its path traversal nature. It is crucial to update to the latest version of the package and implement additional security measures to safeguard your application from potential exploits.
See every vulnerability recorded for uploadfs →
FAQ
The vulnerability is a path traversal issue in the uploadfs library, allowing attackers to manipulate file paths and access unauthorized files on the server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include arbitrary file read, write, and delete operations, which can lead to remote code execution, data breaches, and denial of service.
Yes, the patch is available in version 1.28.0 of the uploadfs package. Update your package to this version to mitigate the vulnerability.
If an immediate update is not possible, implement strict input validation and sanitization to prevent path traversal attacks as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for uploadfs.
