Path Traversal in ApostropheCMS uploadfs Library

Executive Summary

CVE-2026-113651 is a path traversal vulnerability in ApostropheCMS's uploadfs library affecting versions before 1.28.0. The issue occurs because the library fails to properly validate user-supplied file paths in its local storage backend. Attackers can exploit this by injecting parent-directory segments (../) into paths, allowing them to escape the intended upload directory and perform unauthorized file operations on the host filesystem.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses uploadfs versions prior to 1.28.0. Run: npm list uploadfs. If the version is below 1.28.0, the system is vulnerable. Inspect file paths in uploadfs.js and local.js for improper path concatenation without normalization. Look for user-supplied paths containing ../ sequences that could escape the upload directory.

• Check uploadfs version: npm list uploadfs
• Review uploadfs.js and local.js for path concatenation without sanitization
• Monitor filesystem operations for unauthorized access outside the intended upload directory

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read, write, or delete arbitrary files on the server's filesystem. Potential impacts include data exfiltration, unauthorized file modifications, remote code execution, or denial of service. Exploitation requires the application to expose uploadfs operations to untrusted input and depends on the attacker's ability to manipulate file paths.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows arbitrary file read, write, and delete operations outside the intended uploads directory. This could expose sensitive data like configuration files, user credentials, or databases, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Unauthorized file access may lead to data breaches, unauthorized modifications, or system compromise, directly impacting compliance with these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update uploadfs to version 1.28.0 or later. Add path containment validation before any filesystem operation to ensure resolved paths stay within the intended directory. Restrict untrusted path exposure in application code and review file operations for potential escape attempts.

• Update uploadfs: npm update uploadfs@1.28.0
• Implement path containment checks before filesystem operations
• Restrict untrusted path exposure in application logic

Useful 0 Not Useful 0