CVE-2026-113651: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in apostrophecms apostrophe

CVE-2026-113651 is a path traversal vulnerability in the uploadfs library used by ApostropheCMS. Versions of uploadfs prior to 1.28.0 allow attacker-controlled paths containing parent-directory segments to escape the intended upload directory, potentially enabling unauthorized file system access including reads, writes, and deletions. Exploitation depends on whether the application exposes uploadfs operations to untrusted path inputs. The issue is resolved in uploadfs version 1.28.0.

If exploited, an attacker with sufficient privileges and access to the vulnerable uploadfs operations could manipulate file paths to access or modify files outside the designated upload directory. This could lead to limited confidentiality and integrity impacts on the host filesystem. The CVSS vector indicates network attack vector, high attack complexity, required privileges, no user interaction, and low confidentiality and integrity impact.

Upgrade uploadfs to version 1.28.0 or later, where this path traversal vulnerability is fixed. Ensure that applications do not expose uploadfs operations to untrusted or attacker-controlled paths. No other vendor advisory information is provided, so patch status is confirmed by the fix in uploadfs 1.28.0.