GHSA-86WM-68PQ-5JWQ ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

NPM: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

NPM: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

ApostropheCMS: Missing Authorization On Notification PATCH/DELETE Endpoints

Summary The notification module exposes "PATCH" and "DELETE" REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...

ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed. This is greatly mitigated by the fact that there is no automatic public REST API for...

GHSA-XF6W-Q65W-4F2W ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

Impact Even though it is correctly applied to guests, contributors, etc., viewRole is not applied to the general public. This means that a secured content type like @apostrophecms/user can in theory be accessed. This is greatly mitigated by the fact that there is no automatic public REST API for...

NPM: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

NPM: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship viewRole is not applied to the general public vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

GHSA-VWWX-PX9W-CRRC ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

Summary The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

Summary The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...

NPM: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

NPM: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the...

GHSA-GMFX-5G6X-RR72 ApostropheCMS: Path traversal in uploadfs

Summary The uploadfs library's local storage backend does not validate or sanitize user-supplied paths. The prefixPath helper only strips double slashes // and the backend performs direct string concatenation uploadsPath + path. An attacker can inject ../ sequences to escape the intended uploads...

ApostropheCMS: Path traversal in uploadfs

Summary The uploadfs library's local storage backend does not validate or sanitize user-supplied paths. The prefixPath helper only strips double slashes // and the backend performs direct string concatenation uploadsPath + path. An attacker can inject ../ sequences to escape the intended uploads...

NPM: ApostropheCMS: Path traversal in uploadfs

NPM: ApostropheCMS: Path traversal in uploadfs vulnerability discovered by ? in WordPress npm uploadfs versions 1.28.0...

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

Summary sanitize-html 2.17.7 introduced animatesUrlAttribute to block SVG animation elements animate, animateColor, animateMotion, animateTransform, set when their attributeName targets a URL sink like href. However, this check is bypassed when the animation element uses a namespace prefix e.g.,...

GHSA-374F-7CHJ-9948 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

Summary sanitize-html 2.17.7 introduced animatesUrlAttribute to block SVG animation elements animate, animateColor, animateMotion, animateTransform, set when their attributeName targets a URL sink like href. However, this check is bypassed when the animation element uses a namespace prefix e.g.,...

NPM: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

NPM: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection XSS vulnerability discovered by ? in WordPress npm sanitize-html versions = 2.17.7, 2.18.0...

GHSA-HHPH-8536-GFQ5 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

Summary When uploadfs is configured with the Azure backend and sas: true a supported configuration introduced in uploadfs 1.25.0, createContainer builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result...

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

Summary When uploadfs is configured with the Azure backend and sas: true a supported configuration introduced in uploadfs 1.25.0, createContainer builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result...

NPM: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

NPM: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL sas: true vulnerability discovered by ? in WordPress npm uploadfs versions = 1.25.0, 1.28.0...