Apostrophecms vulnerabilities
56 CVEs and advisories name Apostrophecms as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-113711ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
- CVE-2026-113710ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
- CVE-2026-113671ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
- CVE-2026-113669ApostropheCMS: Cross-domain session token in URL confers session takeover
- CVE-2026-113667ApostropheCMS: CAPTCHA response token not URL-encoded
- CVE-2026-113668ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
- CVE-2026-113666ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
- CVE-2026-113665ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
- CVE-2026-113664ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
- CVE-2026-113662ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
- CVE-2026-113661ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
- CVE-2026-113660ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
- CVE-2026-113659ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
- CVE-2026-113658ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
- CVE-2026-113657ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
- CVE-2026-113656ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
- CVE-2026-113649ApostropheCMS: Import API bypasses publication roles for protected content
- CVE-2026-113655ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
- CVE-2026-113654ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
- CVE-2026-113653ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
- CVE-2026-113652ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
- CVE-2026-113651ApostropheCMS: Path traversal in uploadfs
- CVE-2026-113650ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
- CVE-2026-113648ApostropheCMS: Missing Authentication in `cleanExport` Route
- CVE-2026-112958ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
- CVE-2026-112957ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
- CVE-2026-112956ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
- CVE-2026-112955ApostropheCMS: Import archives can exhaust server storage and deny service
- CVE-2026-112954ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
- CVE-2026-112953ApostropheCMS: Exposure of Sensitive Information via predictable export filenames