uploadfs vulnerabilities
CVEs whose affected-version data names the uploadfs package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-113651Low· 3.3PoCApostropheCMS: Path traversal in uploadfs
ApostropheCMS: Path traversal in uploadfs
▾ Twilightuploadfs · uploadfsvia GHSA
CVE-2026-113652Medium· 5.6ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
▾ Sunlituploadfs · uploadfsvia GHSA