apostrophecms has 23 CVEs on record. Disclosure cadence is accelerating: 22 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 20. The median CVSS is 5.4 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-200 (4) and CWE-400 (3). Most affected products: apostrophe (16), @apostrophecms/import-export (3), @apostrophecms/db-connect (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 22 prev 1
Products
- apostrophe 16
- @apostrophecms/import-export 3
- @apostrophecms/db-connect 1
- @apostrophecms/seo 1
- ApostropheCMS 1
- sanitize-html 1
Worst active — by depth score
CVE-2026-44990Critical· 9.3ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API63CVE-2026-113658High· 7.5ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory53CVE-2026-113666High· 7.1ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service51CVE-2026-53608High· 8.7@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag48CVE-2026-112953Medium· 6.0ApostropheCMS: Exposure of Sensitive Information via predictable export filenames45
apostrophecms vulnerabilities
CVEs affecting apostrophecms, newest first. Open any entry for full detail, references, and exploit status.
23 CVEsRSS
CVE-2026-112953Medium· 6.0PoCApostropheCMS: Exposure of Sensitive Information via predictable export filenames
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
CVE-2026-112956Medium· 6.5ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
CVE-2026-113664Medium· 5.3PoCApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal …
CVE-2026-113662Medium· 5.4ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the…
CVE-2026-113661Medium· 5.4ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and thei…
CVE-2026-113668Medium· 5.3ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's oth…
CVE-2026-113710Medium· 5.9ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or l…
CVE-2026-113666High· 7.1PoCApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
CVE-2026-113669Medium· 5.3PoCApostropheCMS: Cross-domain session token in URL confers session takeover
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A …
CVE-2026-113667Medium· 5.3ApostropheCMS: CAPTCHA response token not URL-encoded
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response…
CVE-2026-113671Medium· 4.3PoCApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider U…
CVE-2026-113670Medium· 5.3ApostropheCMS: Page REST API authorization bypass
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: …
CVE-2026-113648Low· 3.1ApostropheCMS: Missing Authentication in `cleanExport` Route
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication a…
CVE-2026-113652Medium· 5.6ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sa…
CVE-2026-113649Medium· 6.5ApostropheCMS: Import API bypasses publication roles for protected content
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can …
CVE-2026-113656Medium· 5.3ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload si…
CVE-2026-113658High· 7.5PoCApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not…
CVE-2026-112954Medium· 5.3PoCApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort orde…
CVE-2026-112955Medium· 6.5ApostropheCMS: Import archives can exhaust server storage and deny service
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before do…
CVE-2026-110904Medium· 5.3PoCApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
CVE-2026-63667Medium· 6.5ApostropheCMS is an open-source Node.js content management system
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and ex…
CVE-2026-53608High· 8.7@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
CVE-2026-44990Critical· 9.3PoCApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-contro…