Vulnerabilities in apostrophecms
56 resultsCVE-2026-44990CRITICALApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`EPSS 0.7%CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-113711HIGHApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportEPSS 0.6%CVE-2026-112953MEDIUMApostropheCMS: Exposure of Sensitive Information via predictable export filenamesEPSS 0.6%CVE-2026-32731CRITICALApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip ExtractionEPSS 0.5%CVE-2026-42853MEDIUM@apostrophecms/cli: Command Injection in apos create via Unsanitized Password InputEPSS 0.5%CVE-2026-112955MEDIUMApostropheCMS: Import archives can exhaust server storage and deny serviceEPSS 0.5%CVE-2026-33888MEDIUMApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APIEPSS 0.5%CVE-2026-113664MEDIUMApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testEPSS 0.5%CVE-2026-113650MEDIUMApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)EPSS 0.5%CVE-2026-63667MEDIUMApostropheCMS: Arbitrary file read via import-export attachment-name path traversalEPSS 0.5%CVE-2026-113656MEDIUMApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSEPSS 0.5%CVE-2026-113666HIGHApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceEPSS 0.4%CVE-2026-112954MEDIUMApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIEPSS 0.4%CVE-2026-39857MEDIUMInformation Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field RestrictionsEPSS 0.4%CVE-2026-113654MEDIUMApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderEPSS 0.4%CVE-2026-71553HIGHApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoSEPSS 0.4%CVE-2026-113669MEDIUMApostropheCMS: Cross-domain session token in URL confers session takeoverEPSS 0.4%CVE-2026-113653MEDIUMApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)EPSS 0.4%CVE-2026-32730HIGHApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token MiddlewareEPSS 0.4%