Vulnerabilidades do Apostrophecms Uploadfs
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Apostrophecms Uploadfs: 2 registro(s), com versões afetadas e correções.
CVE-2026-113652
Média · 5.6
CWE-200 20/10/2026
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
CVE-2026-113651
Baixa · 3.3
CWE-22 20/10/2026
ApostropheCMS: Path traversal in uploadfs
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.