CVE-2026-113666

A flaw was found in ApostropheCMS. An authenticated remote user with draft viewing permissions can supply a specially crafted query projection path when database adapters such as SQLite or PostgreSQL are configured. This action causes the application to delete shared internal runtime properties,...