These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
ApostropheCMS vulnerability allows authenticated editors to cause a denial of service. The vulnerability affects ApostropheCMS versions 4.32.0 and earlier, allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property via PATCH /api/v1/article/:id, leading to a persistent process-wide denial of service until restart. Defenders should assess exposure, prioritiz [truncated]
ApostropheCMS users should assess exposure and prioritize remediation due to a medium-severity vulnerability allowing for limited HTML injection. The vulnerability has a medium CVSS score of 6.1, indicating a moderate security risk. Successful exploitation could lead to limited HTML injection, potentially resulting in minor security consequences. Defenders should verify if their ApostropheCMS version is v [truncated]
ApostropheCMS page module incorrectly handles page moves, allowing authenticated users to bypass permission checks and move controlled pages into restricted subtrees. This issue requires verification of page module configurations and updating to version 4.32.0 or later. The vulnerability affects authenticated users who can exploit the page REST update endpoint to move pages without proper permissions, pot [truncated]
ApostropheCMS import-export module vulnerability allows authenticated contributors to read host files with allowed extensions and publish them at unauthenticated uploads URLs. The issue arises from the module's improper handling of attachment source paths, which can be exploited by importing a crafted archive. This can lead to unauthorized file access and publication. Fixed in version 3.6.2. Users should [truncated]
ApostropheCMS, an open-source Node.js content management system, is vulnerable to a critical security issue identified as CVE-2026-53609. This vulnerability affects versions up to and including 4.30.0. The issue arises from the `apos.util.set()` function, which traverses dot-notation paths without properly sanitizing `__proto__`. This oversight allows an authenticated editor to write arbitrary values to ` [truncated]
ApostropheCMS is an open-source Node.js content management system. Versions up to and including 1.4.2 of the `@apostrophecms/seo` package inject unsanitized user input into `<script>` tag bodies using JavaScript template literals. This allows any user with editor-level access to inject malicious JavaScript, resulting in stored XSS that executes on every page for every visitor. The vulnerability has a CVSS [truncated]
ApostropheCMS, an open-source Node.js content management system, has a vulnerability in versions up to and including 4.30.0. When the `prettyUrls: true` option is enabled on `@apostrophecms/file`, a feature for serving uploaded files at clean URLs, an unauthenticated remote attacker can exploit this to pivot the Apostrophe process to issue outbound HTTP requests against any host reachable on the private n [truncated]
CVE-2026-53606 is a vulnerability in the sanitize-html package, used by ApostropheCMS, a Node.js content management system. The vulnerability arises from the `allowedSchemesAppliedToAttributes` configuration, which by default does not include all HTML attributes that accept URIs. This oversight enables `javascript:` URIs to pass through unmodified, potentially leading to Cross-Site Scripting (XSS) attacks [truncated]
ApostropheCMS, an open-source Node.js content management system, is vulnerable to stored cross-site scripting (XSS) via an unsanitized user display name in the draft version tooltip. This vulnerability is identified as CVE-2026-45014 and has a CVSS score of 5.3, categorized as MEDIUM severity. As of the publication date, no patched versions are available. The vulnerability allows an attacker to inject mal [truncated]
ApostropheCMS, an open-source Node.js content management system, has a password reset flow vulnerability in versions up to and including 4.29.0. The vulnerability allows an unauthenticated attacker who knows a victim's email address to send a crafted reset request. This causes the application to email the victim a reset link pointing to the attacker's domain. When the victim clicks the link, the valid res [truncated]
ApostropheCMS, an open-source Node.js content management system, is vulnerable to an authenticated server-side request forgery (SSRF) attack in the rich-text widget import flow. This vulnerability, tracked as CVE-2026-45012, affects versions up to and including 4.29.0. An authenticated user who can submit or edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget [truncated]
ApostropheCMS version 4.29.0 has a stored cross-site scripting vulnerability in the image widget functionality. A user with the Editor role can configure an image widget link to use a javascript: URL payload. Because editors have permission to publish pages, the malicious widget can be published to the live site. When another user, including an administrator or public visitor, clicks the affected image/li [truncated]
ApostropheCMS's sanitize-html library versions prior to 2.17.4 have a vulnerability that can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript, leading to stored XSS. This issue is patched in version 2.17.4. The vulnerability allows an attacker to inject malicious code, which can then be executed by the application, potentially leading to unauthorized access o [truncated]
ApostropheCMS's @apostrophecms/cli package, up to and including version 3.6.0, contains a command injection vulnerability in the apos create command. User-supplied input from the password prompt is embedded directly into a shell command without proper sanitization or escaping, allowing execution of arbitrary commands on the host system. As of publication, no patched versions are available.
