uploadfs CVE-2026-113651

Requires an ApostropheCMS/uploadfs deployment using the local (filesystem) backend where the host application explicitly routes attacker-controlled path strings into uploadfs read/write/delete operations without sanitizing parent-directory ('../') segments; uploadfs versions prior to 1.28.0. Exploitation is NOT possible against the library in isolation or against integrations that validate/normalize paths before calling uploadfs. Limiting factors: per the vendor CVSS the attacker needs privileged access (PR:H) and conditions are non-default/high-complexity (AC:H), since the vulnerable code path only triggers when an application chooses to expose these operations to untrusted input - a configuration-and-integration dependency, not a default-config remote flaw.

This is a low-priority, high-conditionality path traversal issue (CWE-22) rather than a broadly dangerous flaw. The vendor CVSS of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) is internally consistent with the description: AC:H and PR:H reflect that exploitation is not generic - it requires both privileged/authenticated access and an application that deliberately exposes uploadfs read/write/delete operations to attacker-controlled path input, which the advisory explicitly frames as application-dependent ('Exploitability depends on an application exposing the relevant uploadfs operations to untrusted path'). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are therefore aligned rather than conflicting - moderate-complexity, privilege-gated, library-level issue with limited (Low) confidentiality and integrity impact and no availability impact per the vendor. One caveat: the description states the bug affects file deletion on the host filesystem, yet the vendor vector sets A:N; destructive deletion could plausibly warrant a Low availability impact, so the A:N rating may understate real-world risk for apps that expose delete operations - verify against the GHSA advisory.

An application built on ApostropheCMS that passes untrusted, user-supplied file paths directly into uploadfs local-backend operations allows an authenticated/privileged attacker to supply a path containing '../' segments that escapes the configured upload directory, letting them read, overwrite, or delete files elsewhere on the host filesystem. Because AC:H and PR:H apply, the attacker needs privileged access and a non-default integration that forwards raw paths; no public exploit code was identified at time of analysis.