Uploadfs
Monthly
Account-level Azure SAS tokens are written into every public attachment URL by uploadfs - the storage abstraction used by ApostropheCMS - whenever the Azure backend is configured with sas: true, so anyone who can load a single published attachment can silently harvest credentials for the entire backing storage account. Versions 1.25.0 through 1.27.x are affected; remote attackers need no authentication and no user interaction, but exposure is conditional on that specific Azure configuration, which is why the vendor scores it 5.6 with AC:H while our analysis scores the same vector at 8.8 (S:C/C:H/I:H/A:H) given the account-wide blast radius of the leaked secret. No public exploit code or confirmed active exploitation has been identified at time of analysis, and uploadfs 1.28.0 fixes the issue by no longer embedding the SAS query string in the client construction path.
Path traversal (CWE-22) in uploadfs, the file storage library bundled with ApostropheCMS, allows parent-directory segments in attacker-supplied paths to escape the configured upload directory prior to version 1.28.0, affecting file reads, writes, and deletions on the host filesystem through the local backend. The flaw is not exploitable against the library in isolation: it only triggers when a host application explicitly routes unsanitized, attacker-controlled path strings into uploadfs read, write, or delete operations, which is why the vendor scores it as high-complexity with privileged access requirements (AC:H/PR:H). There is no public exploit identified at time of analysis and no CISA KEV listing; this is a low-priority, high-conditionality issue rather than a broadly dangerous flaw.
Account-level Azure SAS tokens are written into every public attachment URL by uploadfs - the storage abstraction used by ApostropheCMS - whenever the Azure backend is configured with sas: true, so anyone who can load a single published attachment can silently harvest credentials for the entire backing storage account. Versions 1.25.0 through 1.27.x are affected; remote attackers need no authentication and no user interaction, but exposure is conditional on that specific Azure configuration, which is why the vendor scores it 5.6 with AC:H while our analysis scores the same vector at 8.8 (S:C/C:H/I:H/A:H) given the account-wide blast radius of the leaked secret. No public exploit code or confirmed active exploitation has been identified at time of analysis, and uploadfs 1.28.0 fixes the issue by no longer embedding the SAS query string in the client construction path.
Path traversal (CWE-22) in uploadfs, the file storage library bundled with ApostropheCMS, allows parent-directory segments in attacker-supplied paths to escape the configured upload directory prior to version 1.28.0, affecting file reads, writes, and deletions on the host filesystem through the local backend. The flaw is not exploitable against the library in isolation: it only triggers when a host application explicitly routes unsanitized, attacker-controlled path strings into uploadfs read, write, or delete operations, which is why the vendor scores it as high-complexity with privileged access requirements (AC:H/PR:H). There is no public exploit identified at time of analysis and no CISA KEV listing; this is a low-priority, high-conditionality issue rather than a broadly dangerous flaw.