176 matches found
CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...
CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...
CVE-2026-71553
ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...
CVE-2026-63667
ApostropheCMS versions before 3.6.2 are vulnerable to arbitrary file read via path traversal in the import-export module. The file packages/import-export/lib/formats/gzip.js builds an attachment source path using attacker-controlled _id, name, and extension fields from aposAttachments.json withou...
CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...
CVE-2026-63667
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...
CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...
CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...
CVE-2026-63670
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...
CVE-2026-63670
ApostropheCMS (open-source Node.js CMS) is vulnerable to a mutation XSS in sanitizeHtml() (packages/sanitize-html/index.js) prior to version 2.17.6 . When textarea or xmp is included in allowedTags, a literal solidus after the raw-text end-tag name (e.g., ) is treated as text by htmlparser2 , and...
CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...
CVE-2026-63669 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...
CVE-2026-63669
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...
CVE-2026-63669
In ApostropheCMS before 4.32.0, the page module's move() skips the destination parent's _create permission check due to an archive-condition bug, allowing an authenticated editor or contributor to move a page into a restricted subtree and re-rank protected sibling pages via nudgeNewPeers() update...
CVE-2026-63669 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...
PT-2026-76770
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 3.6.2 Description The import-export module in packages/import-export/lib/formats/gzip.js fails to properly validate that the resolved attachment source path remains within the extracted attachments directory. An...
PT-2026-76776
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.32.1 Description An authenticated editor can cause a persistent process-wide denial of service until a restart occurs. This happens because the PATCH '/api/v1/article/:id' endpoint accepts the inherited path...
PT-2026-76771
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 2.17.6 Description The sanitizeHtml function in packages/sanitize-html/index.js allows disallowed executable markup to pass through when textarea or xmp are included in allowedTags. This occurs because a literal...
PT-2026-76761
Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.32.0 Description The page module's move operation fails to enforce the create permission of the destination parent. This occurs because the oldParent archive condition disables the check for ordinary moves...
