CVE-2026-112953
Received Received - Intake

Predictable Export Filename in ApostropheCMS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112953
EUVD
EUVD-2026-105103

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.34.0
@apostrophecms import-export < 3.7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ApostropheCMS versions prior to 3.7.1 of the import-export module generate predictable export filenames. These filenames can be guessed or brute-forced by unauthenticated attackers to download another user's export from a publicly readable storage directory before the archive expires or is removed. The vulnerability requires a user with export permission to first create the archive.

Detection Guidance

Check for unauthorized access to the /exports/ directory in the uploads folder. Look for predictable filenames in the format [shortname]-[type]-[timestamp].js. Monitor network traffic for requests to /uploads/exports/[filename] within the 10-minute window.

Impact Analysis

An attacker could access exported archives containing sensitive data such as documents, metadata, and attachments. The default 10-minute expiration window limits exposure but does not prevent access during that time. Sites using public upload storage are most affected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations if exported data includes protected information.

Mitigation Strategies

Upgrade the @apostrophecms/import-export module to version 3.7.1 or later. Configure the system to serve exports via authenticated routes instead of public URLs. Add high-entropy components to filenames to prevent guessing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112953. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart