Apostrophecms Apostrophe vulnerabilities

CVE-2026-53609 [CRITICAL] CWE-1321 CVE-2026-53609: ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4 ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` cause

CVE-2026-32730 [HIGH] CWE-287 CVE-2026-32730: ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer to ApostropheCMS is an open-source content management framework. Prior to version 4.28.0, the bearer token authentication middleware in `@apostrophecms/express/index.js` (lines 386-389) contains an incorrect MongoDB query that allows incomplete login tokens — where the password was verified but TOTP/MFA requirements were NOT — to be used as fully authent

CVE-2026-45013 [HIGH] CWE-20 CVE-2026-45013: ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29 ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's

CVE-2026-45012 [HIGH] CWE-918 CVE-2026-45012: ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29 ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For i

CVE-2026-35569 [HIGH] CWE-79 CVE-2026-35569: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including tags, attributes, and JSON-LD structured data. An att

CVE-2026-63667 [MEDIUM] CWE-22 CVE-2026-63667: ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachme

CVE-2026-45011 [HIGH] CWE-79 CVE-2026-45011: ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to t

CVE-2026-71553 [HIGH] CWE-1321 CVE-2026-71553: ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and ca

CVE-2026-63669 [MEDIUM] CWE-639 CVE-2026-63669: ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module' ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the p

CVE-2026-33888 [MEDIUM] CWE-200 CVE-2026-33888: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the getRestQuery method of the @apostrophecms/piece-type module, where the method checks whether a MongoDB projection has already been set before applying the admin-configured publicApiProjection. An unauthent

CVE-2026-39857 [MEDIUM] CWE-200 CVE-2026-39857: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain an authorization bypass vulnerability in the choices and counts query parameters of the REST API, where these query builders execute MongoDB distinct() operations that bypass the publicApiProjection restrictions intended to limit which fields are exp

CVE-2026-40186 [MEDIUM] CWE-79 CVE-2026-40186: ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of the ApostropheCMS-maintained sanitize-html package bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). ApostropheCMS version 4.28.0 is affected through its dependenc

CVE-2026-45014 [MEDIUM] CWE-79 CVE-2026-45014: ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29 ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no known patched versions are available.

CVE-2026-63670 [MEDIUM] CWE-79 CVE-2026-63670: ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() c ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that c

CVE-2026-84371 [MEDIUM] CWE-79 CVE-2026-84371: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simp ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling

CVE-2026-33889 [MEDIUM] CWE-79 CVE-2026-33889: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor validation intended for CSS custom properties, and the launder.string() call performs only type coercion without

CVE-2026-53607 [LOW] CWE-918 CVE-2026-53607: ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4 ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecms/file` (a documented SEO feature for serving uploaded files at clean URLs), the public pretty-URL handler builds the upstream URL using the raw `Host` HTTP request header. That URL is then `fetc

CVE-2026-33877 [LOW] CWE-208 CVE-2026-33877: ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. When a user is not found, the handler returns after a fixed 2-second artificial d