Apostrophecms vulnerabilities
56 CVEs and advisories name Apostrophecms as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-112952ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
- CVE-2026-112951ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
- CVE-2026-110904ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 c
- CVE-2026-84371ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
- CVE-2026-71553ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
- CVE-2026-63667ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
- CVE-2026-63670ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
- CVE-2026-63669ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
- CVE-2026-53609Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
- CVE-2026-53608@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
- CVE-2026-53607@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
- CVE-2026-53606sanitize-html has an incomplete URI scheme validation that allows javascript: URIs through action, formaction, data, poster, and background attributes
- CVE-2026-45014Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip
- CVE-2026-45013Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation
- CVE-2026-45012Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
- CVE-2026-45011Apostrophe has stored XSS via javascript: URL in Image Widget Link
- CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
- CVE-2026-42853@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
- CVE-2026-40186ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
- CVE-2026-39857Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions
- CVE-2026-35569ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS
- CVE-2026-33889ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context
- CVE-2026-33888ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API
- CVE-2026-33877ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint
- CVE-2026-32731ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
- CVE-2026-32730ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware