apostrophecms apostrophe
50 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-113711 | < 4.33.0 | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export | HIGH 7.5 | 0.6 % | ||
| CVE-2026-113710 | < 4.33.0 | ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-113671 | >= 4.25.0, < 4.33.0 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-113669 | < 4.33.0 | ApostropheCMS: Cross-domain session token in URL confers session takeover | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-113667 | < 4.33.0 | ApostropheCMS: CAPTCHA response token not URL-encoded | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-113668 | < 4.33.0 | ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-exist… | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-113666 | < 4.33.0 | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of se… | HIGH 7.1 | 0.4 % | ||
| CVE-2026-113665 | < 4.33.0 | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints | LOW 3.7 | 0.3 % | ||
| CVE-2026-113664 | < 4.33.0 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-113662 | < 4.33.0 | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-113661 | < 4.33.0 | ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-113660 | < 4.33.0 | ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers | MEDIUM 4.3 | 0.4 % | ||
| CVE-2026-113659 | < 4.33.0 | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-113658 | < 4.33.0 | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory | HIGH 7.5 | 0.6 % | ||
| CVE-2026-113657 | < 4.33.0 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) | LOW 3.7 | 0.3 % | ||
| CVE-2026-113656 | < 4.33.0 | ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-113649 | < 4.34.0 | ApostropheCMS: Import API bypasses publication roles for protected content | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-113655 | < 4.33.0 | ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-113654 | < 4.33.0 | ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-113653 | < 4.33.0 | ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-113652 | < 4.33.0 | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true) | MEDIUM 5.6 | 0.3 % | ||
| CVE-2026-113651 | < 4.33.0 | ApostropheCMS: Path traversal in uploadfs | LOW 3.3 | 0.3 % | ||
| CVE-2026-113650 | < 4.34.0 | ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not … | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-113648 | < 4.34.0 | ApostropheCMS: Missing Authentication in `cleanExport` Route | LOW 3.1 | 0.3 % | ||
| CVE-2026-112958 | < 4.34.0 | ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-112957 | < 4.34.0 | ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privile… | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-112956 | < 4.34.0 | ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-112955 | < 4.34.0 | ApostropheCMS: Import archives can exhaust server storage and deny service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-112954 | < 4.34.0 | ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-112953 | < 4.34.0 | ApostropheCMS: Exposure of Sensitive Information via predictable export filenames | MEDIUM 6.0 | 0.6 % | ||
| CVE-2026-112952 | < 4.34.0 | ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-112951 | < 4.34.0 | ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-84371 | >= 1.9.0, < 2.17.7 | ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-71553 | <= 4.32.0 | ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS | HIGH 7.1 | 0.4 % | ||
| CVE-2026-63667 | < 3.6.2 | ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-63670 | < 2.17.6 | ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-63669 | < 4.32.0 | ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside … | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-53609 | <= 4.30.0 | Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-53607 | <= 4.30.0 | @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header | LOW 3.7 | 0.3 % | ||
| CVE-2026-45014 | <= 4.29.0 | Apostrophe Vulnerable to Stored Cross-Site Scripting via Unsanitized User Display Name in Draft Version Tooltip | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-45013 | <= 4.29.0 | Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation | HIGH 8.1 | 0.3 % | ||
| CVE-2026-45012 | <= 4.29.0 | Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget | HIGH 7.6 | 0.2 % | ||
| CVE-2026-45011 | = 4.29.0 | Apostrophe has stored XSS via javascript: URL in Image Widget Link | HIGH 7.3 | 0.3 % | ||
| CVE-2026-40186 | >= 4.28.0, < 4.29.0 | ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-39857 | < 4.29.0 | Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-35569 | < 4.29.0 | ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS | HIGH 8.7 | 0.3 % | ||
| CVE-2026-33889 | < 4.29.0 | ApostropheCMS: Stored XSS via CSS Custom Property Injection in `@apostrophecms/color-field` Escaping Style Tag Context | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-33888 | < 4.29.0 | ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-33877 | < 4.29.0 | ApostropheCMS: User Enumeration via Timing Side Channel in Password Reset Endpoint | LOW 3.7 | 0.4 % | ||
| CVE-2026-32730 | < 4.28.0 | ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware | HIGH 8.1 | 0.4 % |