uploadfs vulnerabilities
CVEs whose affected-version data names the uploadfs package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-113651Low· 3.3PoCApostropheCMS: Path traversal in uploadfs
ApostropheCMS: Path traversal in uploadfs
▾ Twilightuploadfs · uploadfsEPSS 0.33%via GHSA
CVE-2026-113652Medium· 5.6ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sa…
▾ Sunlitapostrophecms · apostropheEPSS 0.28%via CVEORG