PT-2026-33172 · Unknown · Apostrophe Cms

Chittu13 + 1 · CVE-2026-35569 · Published 2026-04-15 · Updated 2026-05-02

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.29.0

Description A stored cross-site scripting issue exists in SEO-related fields, specifically the SEO Title and Meta Description. User-controlled input is rendered without proper output encoding into HTML contexts, including tags, <meta> attributes, and JSON-LD structured data. This allows an attacker to inject and execute arbitrary JavaScript in the browser of authenticated users. This can be used to perform authenticated API requests to endpoints such as '/api/v1/@apostrophecms/user' and exfiltrate sensitive data, including usernames, email addresses, and roles, to an external server.

Recommendations Update to version 4.29.0.

Exploit

Fix

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-79

CWE-116

Related Identifiers

CVE-2026-35569

GHSA-855C-R2VQ-C292

Affected Products

Apostrophe Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35569.json · Exploit
• 🔥 https://github.com/Chittu13/cve-research/tree/main/CVE-2026-35569 · Exploit
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-855c-r2vq-c292 · Vendor Advisory
• https://github.com/apostrophecms/apostrophe/commit/0e57dd07a56ae1ba1e3af646ba026db4d0ab5bb3 · Patch
• https://osv.dev/vulnerability/GHSA-855c-r2vq-c292 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35569 · Security Note
• https://github.com/apostrophecms/apostrophe · Note
• https://twitter.com/HugoValters/status/2050545564870119926 · Twitter Post
• https://twitter.com/CVEnew/status/2044701620022530480 · Twitter Post