These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames. The @apostrophecms/import-export module generates predictable export filenames based on site shortName, document type, timestamp, and format extension. This allows unauthorized access to sensitive information via unauthenticated HTTP GET requests. Defenders should assess exposure and implement compensating controls to preve [truncated]
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users. The vulnerability allows editor-level users with access to document _id values to read the full content of admin-only pages and their privileged fields. Defenders should prioritize verifying exposure and assessing potential impact. The fix involves updating to [truncated]
ApostropheCMS has a stored XSS vulnerability via unescaped widget style attribute serialization. An attacker who can edit a widget can inject malicious HTML event-handler attributes by including a double quote in the style value, terminating the style attribute. The payload executes in the Apostrophe site origin when the affected published page is rendered.
The `@apostrophecms/import-export` package has a vulnerability in the `cleanExport` route, allowing unauthenticated access. This could lead to unauthorized data access or disruption of import/export operations. Defenders should assess exposure and apply patches or compensating controls. The vulnerability is caused by a missing authentication check in the `cleanExport` route, which is defined in `packages/ [truncated]
ApostropheCMS has a vulnerability in its public REST API that allows unauthenticated attackers to bypass the publicApiProjection setting, which is meant to restrict access to certain document fields. This is possible due to the way query builders, specifically 'search' and 'sort', are applied before the projection is enforced. As a result, attackers can use the 'search' parameter as a value oracle to conf [truncated]
ApostropheCMS color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix. The vulnerability exists due to the color field accepting any string that begins with a valid rgb() / hsl() color. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered, the payload executes, resulting in stored XSS. The root caus [truncated]
CVE-2026-113650 debrief: ApostropheCMS sanitize-html unbounded recursion vulnerability allows for stack overflow and arbitrary nesting. The vulnerability occurs when an iframe is discarded and its raw-text content is re-sanitized by a recursive call to sanitizeHtml(text, options). This can lead to a stack overflow error with a small crafted input and arbitrary nesting of HTML elements. Defenders handling [truncated]
ApostropheCMS Import API bypasses publication roles for protected content due to missing publish permission checks in the import process. The import gate in canImportOrExport() checks the type's import configuration and view permission. However, the write helpers then call document-manager insert/update directly, including operations on published variants, without the normal publish permission check or be [truncated]
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content. The overrideDuplicates() continuation in @apostrophecms/import-export accepts client-supplied replacement choices, allowing contributors to overwrite published content. Defenders of ApostropheCMS systems, specifically those using @apostrophecms/import-export version 3.7.0 or earlier, should assess exposure and app [truncated]
ApostropheCMS Import archives can exhaust server storage and deny service due to lack of resource quotas and failure cleanup in the @apostrophecms/import-export package, version 3.7.0. The issue has been addressed in version 3.7.1. This vulnerability allows attackers to exhaust server storage and deny service. Defenders should verify exposure and apply the remediation to prevent denial-of-service attacks. [truncated]
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export. The @apostrophecms/import-export package is vulnerable to an unauthenticated resource exhaustion attack due to a missing authorize callback in the bigUploadMiddleware function. This allows an unauthenticated remote attacker to create server-side upload state, write chunk data to upload [truncated]
The `uploadfs` library's local storage backend does not validate or sanitize user-supplied paths, allowing an attacker to inject `../` sequences to escape the intended uploads directory. This results in arbitrary file read, write, and delete on the host filesystem. Defenders should assess exposure and prioritize patching for ApostropheCMS deployments and uploadfs users. The vulnerability is caused by the [truncated]
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL when configured with `sas: true`. This allows anyone who can see an attachment URL to read, overwrite, delete, and list every blob in the container for the SAS lifetime. The issue arises from a credential-bearing client URL reused as the public base URL. Defenders should assess exposure and prioritize remed [truncated]
ApostropheCMS import-export NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document. This vulnerability affects ApostropheCMS installations using the @apostrophecms/import-export module. The issue arises from the module's update-by-key feature, which allows an imported document to carry a <field>:key property. A crafted import can exploit this feature to mat [truncated]
ApostropheCMS has a vulnerability in the REST route `GET /api/v1/<piece-type>/:_id/locales` where it omits the public-API authorization gate that other read routes enforce. This allows an unauthenticated caller to query the route for any document `_id` and learn whether the document exists and which locales it is published in. The vulnerability was confirmed at ApostropheCMS version 4.32.2 and is fixed in [truncated]
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF. The vulnerability allows an authenticated editor to send unauthorized PATCH requests with attacker-chosen Host headers, potentially reaching internal hosts and ports. Defenders should assess exposure and apply patches to prevent authenticated SSRF attacks. The affected code lives in [truncated]
CVE-2026-113658 debrief: ApostropheCMS unauthenticated CSV import requests leave rejected uploads in the system temporary directory. This occurs because Multer writes the file before its extension is checked, and the rejection path does not remove the temporary file. Defenders should assess exposure and prioritize remediation for ApostropheCMS instances with publicly accessible rich-text-widget endpoints. [truncated]
ApostropheCMS cross-domain session token vulnerability allows session takeover. The vulnerability arises from Apostrophe's cross-domain session migration emitting a single-use session token as a URL query parameter, which can be used by any client to adopt the target user's full session with no credentials. Defenders responsible for ApostropheCMS deployments should assess exposure and prioritize verificat [truncated]
CVE-2026-113656: ApostropheCMS Unauthenticated Unbounded Multipart Upload Leads to Disk-Exhaustion DoS. The vulnerability allows unauthenticated users to upload large files, causing disk exhaustion. Defenders should verify exposure and apply patches to prevent exploitation. The @apostrophecms/form package prior to version 1.5.5 is affected, and updating to version 1.5.5 or later mitigates the vulnerabilit [truncated]
ApostropheCMS CAPTCHA response token not URL-encoded vulnerability allows a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request, leading to verification failures and potential automated bypass probing. The vulnerability affects ApostropheCMS deployments using @apostrophecms/form, @apostrophecms/login-recaptcha, and @apostrophecms/login-hcaptcha packages. Defenders should as [truncated]
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization. Authenticated low-privileged editors can reorder pages under restricted parents, triggering unguarded database writes. This issue arises from the move() operation in @apostrophecms/page, which does not properly enforce create rights when reordering pages under a restr [truncated]
A low-privileged authenticated user can cause a process-wide denial of service in @apostrophecms/db-connect by sending a malicious request that deletes a shared runtime method. The vulnerability affects ApostropheCMS deployments using @apostrophecms/db-connect, particularly those with SQLite or PostgreSQL adapters. Defenders should assess exposure and apply patches or mitigations to prevent exploitation. [truncated]
The sanitize-html package incorrectly handles content within non-text tags, such as <noscript>, allowing certain markup to be treated as ordinary body content rather than raw text. This can lead to the sanitizer emitting elements that a browser would not render, potentially resulting in unintended content being displayed. The issue arises when an ancestor of a <noscript> element is closed, causing the dis [truncated]
ApostropheCMS vulnerability allows authenticated editors to cause a denial of service. The vulnerability affects ApostropheCMS versions 4.32.0 and earlier, allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property via PATCH /api/v1/article/:id, leading to a persistent process-wide denial of service until restart. Defenders should assess exposure, prioritiz [truncated]
ApostropheCMS users should assess exposure and prioritize remediation due to a medium-severity vulnerability allowing for limited HTML injection. The vulnerability has a medium CVSS score of 6.1, indicating a moderate security risk. Successful exploitation could lead to limited HTML injection, potentially resulting in minor security consequences. Defenders should verify if their ApostropheCMS version is v [truncated]
ApostropheCMS page module incorrectly handles page moves, allowing authenticated users to bypass permission checks and move controlled pages into restricted subtrees. This issue requires verification of page module configurations and updating to version 4.32.0 or later. The vulnerability affects authenticated users who can exploit the page REST update endpoint to move pages without proper permissions, pot [truncated]
ApostropheCMS import-export module vulnerability allows authenticated contributors to read host files with allowed extensions and publish them at unauthenticated uploads URLs. The issue arises from the module's improper handling of attachment source paths, which can be exploited by importing a crafted archive. This can lead to unauthorized file access and publication. Fixed in version 3.6.2. Users should [truncated]
ApostropheCMS, an open-source Node.js content management system, is vulnerable to a critical security issue identified as CVE-2026-53609. This vulnerability affects versions up to and including 4.30.0. The issue arises from the `apos.util.set()` function, which traverses dot-notation paths without properly sanitizing `__proto__`. This oversight allows an authenticated editor to write arbitrary values to ` [truncated]
ApostropheCMS's @apostrophecms/seo package up to version 1.4.2 is vulnerable to stored XSS due to improper sanitization of Google Analytics and Google Tag Manager IDs. This allows editor-level users to inject malicious scripts, potentially leading to stored XSS attacks on every page for every visitor, exposure of sensitive data, and disruption of site functionality and user experience. Defenders should as [truncated]
ApostropheCMS, an open-source Node.js content management system, has a vulnerability in versions up to and including 4.30.0. When the `prettyUrls: true` option is enabled on `@apostrophecms/file`, a feature for serving uploaded files at clean URLs, an unauthenticated remote attacker can exploit this to pivot the Apostrophe process to issue outbound HTTP requests against any host reachable on the private n [truncated]
