{"id":"EUVD-2026-105177","revision":"2e2bdcdc7db94e069b0f5f4b2320d174","records":[{"revision":"2e2bdcdc7db94e069b0f5f4b2320d174","observedAt":"2026-11-07T04:34:08.261+00:00","statement":{"source":"euvd","id":"EUVD-2026-105177","aliases":["CVE-2026-113651","GHSA-gmfx-5g6x-rr72"],"title":"ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape …","description":"ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path. This issue is fixed in uploadfs 1.28.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","score":3.3,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-gmfx-5g6x-rr72","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105177","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 4:22:30 PM","dateUpdated":"Oct 20, 2026, 5:20:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105177","identifiers":["EUVD-2026-105177","CVE-2026-113651","GHSA-gmfx-5g6x-rr72"]},"retained":false,"historicalAffected":[]}],"coverage":[]}