Please help us keep all ApostropheCMS projects safe. If you become aware of a security vulnerability in ApostropheCMS or any official modules, please contact us via email at security@apostrophecms.com.
Repository navigation
Security: apostrophecms/apostrophe
Security
SECURITY.md
-
Import archives can exhaust server storage and deny serviceGHSA-9g7p-m758-rp72 published
Oct 14, 2026 by boutellModerate -
Archive duplicate continuation lets contributors overwrite published contentGHSA-jf5h-36mg-rp6x published
Oct 14, 2026 by boutellModerate -
Import API bypasses publication roles for protected contentGHSA-5m22-7pfq-vp65 published
Oct 14, 2026 by boutellModerate -
Exposure of Sensitive Information via predictable export filenamesGHSA-5gc8-frw3-3vqm published
Oct 14, 2026 by boutellModerate -
sanitize-html 2.18.0: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)GHSA-c9rx-x947-fp3h published
Oct 14, 2026 by boutellModerate -
Missing Authentication in `cleanExport` RouteGHSA-rw26-wwfc-9wvm published
Oct 14, 2026 by boutellLow -
Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIGHSA-rqgm-cfrp-4hx8 published
Oct 14, 2026 by boutellModerate -
Stored XSS via Unescaped Widget Style Attribute SerializationGHSA-7jg5-frgc-c67w published
Oct 14, 2026 by boutellModerate -
Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixGHSA-vmgj-9cwm-cf3h published
Oct 14, 2026 by boutellModerate -
GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersGHSA-vh56-5m88-39rq published
Oct 14, 2026 by boutellModerate
Learn more about advisories related to apostrophecms/apostrophe in the GitHub Advisory Database