apostrophecms

Records66All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

apostrophecms records in CISA KEV

No apostrophecms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Apostrophecms 9 records HIGH Sanitize-html 8 records MEDIUM Import-export 1 record HIGH

Records

66 records

TI-2026-25223 CVE-2026-32731 · GHSA-mwxc-m426-3f78

ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

HIGH 76

ApostropheCMS is an open-source content management framework.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0055 Published 2026-03-18 Fixed in 3.5.3 CWE-22

TI-2026-32848 CVE-2026-44990 · GHSA-rpr9-rxv7-x643

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

HIGH 75

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00684 Published 2026-06-12 Partial fix · 2.17.4 CWE-79

TI-2026-38664 CVE-2026-53608 · GHSA-wf43-fpp3-cf65

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

HIGH 73

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00256 Published 2026-06-12 Fixed in 1.5.0 CWE-79

TI-2026-27673 CVE-2026-35569 · GHSA-855c-r2vq-c292

ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS

HIGH 73

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00298 Published 2026-04-15 Fixed in 4.29.0 CWE-116

TI-2026-76992 CVE-2026-113711 · GHSA-86wm-68pq-5jwq

Unauthenticated resource exhaustion via ApostropheCMS import routes

HIGH 72

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00561 Published 2026-10-20 Fixed in 4.33.0, 3.7.0 CWE-400

TI-2026-76974 CVE-2026-113658 · GHSA-qhcq-9pm2-c9w9

ApostropheCMS leaves rejected CSV uploads in temporary directory

HIGH 72

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00615 Published 2026-10-20 Fixed in 4.33.0 CWE-400

TI-2026-38665 CVE-2026-53609 · GHSA-6h5j-32cf-4253

Prototype pollution in apostrophecms apostrophe

HIGH 72

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00346 Published 2026-06-12 Fixed in 4.31.0 CWE-1321

TI-2026-32871 CVE-2026-45013 · GHSA-gf43-24g3-5hw2

Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation

HIGH 70

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00305 Published 2026-06-12 No fix listed CWE-20

TI-2026-25222 CVE-2026-32730 · GHSA-v9xm-ffx2-7h35

ApostropheCMS MFA/TOTP Bypass via Incorrect MongoDB Query in Bearer Token Middleware

HIGH 70

ApostropheCMS is an open-source content management framework.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00384 Published 2026-03-18 Fixed in 4.28.0 CWE-287

TI-2026-32870 CVE-2026-45012 · GHSA-pr28-mf3q-qpg6

Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget

HIGH 66

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00235 Published 2026-06-12 No fix listed CWE-918

TI-2026-32869 CVE-2026-45011 · GHSA-5f64-7vfc-rcx6

Apostrophe has stored XSS via javascript: URL in Image Widget Link

HIGH 65

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00267 Published 2026-06-12 No fix listed CWE-116

TI-2026-76981 CVE-2026-113666 · GHSA-j5rq-xfvr-p969

Prototype pollution in ApostropheCMS db-connect causes service outage

MEDIUM 64

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00444 Published 2026-10-20 Fixed in 4.33.0, 1.1.0 CWE-1321

TI-2026-31060 CVE-2026-42853 · GHSA-hcwq-x9fw-8cfq

@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input

MEDIUM 64

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 6.5 Local High privileges User interaction EPSS 0.00536 Published 2026-06-12 No fix listed CWE-78

TI-2026-76962 CVE-2026-113650 · GHSA-c9rx-x947-fp3h

Uncontrolled recursion in sanitize-html discarded iframe handling

MEDIUM 63

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0048 Published 2026-10-20 Partial fix · 4.34.0, 2.18.1 CWE-674

TI-2026-76921 CVE-2026-112954 · GHSA-rqgm-cfrp-4hx8

ApostropheCMS publicApiProjection bypass via public REST API search and sort

MEDIUM 63

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00444 Published 2026-10-20 Fixed in 4.34.0 CWE-200

TI-2026-74568 CVE-2026-110904

Authentication bypass in ApostropheCMS REST API page reading

MEDIUM 63

ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00302 Published 2026-10-15 Fixed in 4.33.0 CWE-863

TI-2026-28738 CVE-2026-39857 · GHSA-c276-fj82-f2pq

Information Disclosure via `choices`/`counts` Query Parameters Bypassing publicApiProjection Field Restrictions

MEDIUM 63

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00435 Published 2026-04-15 Fixed in 4.29.0 CWE-200

TI-2026-26246 CVE-2026-33888 · GHSA-xhq9-58fw-859p

ApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST API

MEDIUM 63

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00512 Published 2026-04-15 Fixed in 4.29.0 CWE-200

TI-2024-14258 CVE-2024-21501 · GHSA-rm97-x556-q36h

Information disclosure in sanitize-html

MEDIUM 63

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dep…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01027 Published 2024-02-24 Partial fix · 2.12.1 CWE-200

TI-2026-45293 CVE-2026-63667 · GHSA-79qf-vqgc-7xx3

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

MEDIUM 62

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00465 Published 2026-08-17 Fixed in 3.6.2 CWE-22

TI-2026-76920 CVE-2026-112953 · GHSA-5gc8-frw3-3vqm

Predictable export filenames expose exports in ApostropheCMS

MEDIUM 60

ApostropheCMS is an open-source Node.js content management system.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00557 Published 2026-10-20 Fixed in 4.34.0, 3.7.1 CWE-200

TI-2026-45295 CVE-2026-63670 · GHSA-jxwj-j7wr-gfrw

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

MEDIUM 60

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00327 Published 2026-08-17 Fixed in 2.17.6 CWE-79

TI-2026-29000 CVE-2026-40186 · GHSA-9mrh-v2v3-xpfm

ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements

MEDIUM 60

ApostropheCMS is an open-source Node.js content management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00248 Published 2026-04-15 Partial fix · 4.29.0, 2.17.2 +1 CWE-79

TI-2019-15279 CVE-2019-25225 · GHSA-qhxp-v273-g94h

Cross-site scripting in sanitize-html

MEDIUM 60

`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00269 Published 2025-09-08 Fixed in 2.0.0-beta CWE-79

TI-2014-08427 CVE-2014-125128 · GHSA-389w-f784-rjg3

Cross-site scripting in sanitize-html

MEDIUM 60

'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00274 Published 2025-09-08 Fixed in 1.0.3 CWE-79

Open these records in search →