Apostrophecms vulnerabilities
We track 13 vulnerabilities in Apostrophecms products across 6 products. 13 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest Apostrophecms vulnerabilities
- 7.5 High severity
apostrophe: Uncontrolled Resource Consumption
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perfor
- 7.1 High severity
apostrophe: Uncontrolled Resource Consumption
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path that traverses through a constructor prototype chain to a shar
- 7.5 High severity
apostrophe: Uncontrolled Resource Consumption
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file
- 7.1 High severity
apostrophe: Improperly Controlled Modification of Object Prototype Attributes
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authentica
- 9.1 Critical severity
apostrophe: Improperly Controlled Modification of Object Prototype Attributes
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prot
- 8.7 High severity
@apostrophecms/seo: Improper Neutralization of Input During Web Page Generation
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package injects the Google Analytics Tracking ID (`seoGoogleTrackingId`) and Google Tag Manager ID (`seoGoogleTagManager`) directl
- 8.1 High severity
ApostropheCMS is an open-source Node.js content management system.
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when
- 7.6 High severity
apostrophe: Server-Side Request Forgery
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget c
- 7.3 High severity
apostrophe: Improper Neutralization of Input During Web Page Generation
ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload
- 9.3 Critical severity
sanitize-html: Improper Neutralization of Input During Web Page Generation
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a d
- 8.7 High severity
apostrophe: Improper Neutralization of Input During Web Page Generation
ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper outp
- 9.9 Critical severity
import-export: Improper Limitation of a Pathname to a Restricted Directory
ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of `@apostrophecms/import-export`, The `extract()` function in `gzip.js` constructs file-write paths using `fs.createWriteStream(path.join(exportPath, header.name))`. `path.jo
- 8.1 High severity
apostrophe: Improper Authentication
ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — whe