ApostropheCMS uploadfs allows attacker‑controlled paths containing parent‑directory segments to escape the configured upload directory. This can read, write, or delete any file accessible to the backend process. The vulnerability is rated CVSS 3.3, indicating low overall severity, but it introduces a direct access‑control bypass that could lead to data exposure or defacement.

ApostropheCMS’s uploadfs component is affected on all releases before 1.28.0. Users running any version of uploadfs older than 1.28.0 with a publicly exposed upload endpoint that accepts arbitrary path parameters are vulnerable.

Exploitation requires the application to expose upload statements with untrusted path inputs. While the CVSS score is low and the EPSS is not available, the issue is not listed in CISA KEV. An attacker who can supply a crafted path can read or modify files on the host file system, potentially compromising sensitive data or injecting malicious content. Assessment of risk should consider whether the upload endpoint is publicly accessible and whether it accepts parameters that influence the file path.