ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-112953

ApostropheCMS is an open-source Node.js content management system.

Published Oct 20, 2026 · catalog updated Oct 21, 2026 · ApostropheCMS is an open-source

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-112953. EPSS is 0.56%. Act only if a listed version of ApostropheCMS is an open-source is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (ApostropheCMS is an open-source).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.56%
Remediation
Version ranges on file
Affected products
npm @apostrophecms · npm @apostrophecms/import-export

## Summary When a user exports content through , the module copies the generated archive into uploadfs at and returns a public URL under . The filename is fully deterministic: site , document type, a timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises ). That is a different model from attachment URLs, which rely on hard-to-guess IDs. Sites that disable export, store uploads on a private backend with no anonymous read, or serve only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout. Import-only workflows and imports themselves are out of scope; this is specific to the export download URL. ## Affected configurations All of the following must apply: 1. The module is enabled and export is allowed for at least one page or piece type, **and** 2. Export files are served the usual way: to and delivery via the public URL (default local uploadfs or any deployment that exposes the same path without per-file auth). If export is turned off per type or globally, or is not world-readable, an anonymous attacker cannot pull the file over HTTP—but a co-resident attacker with filesystem or bucket listing access would still see guessable names. ## Remediation - Put a high-entropy component in the export filename (e.g. ), **or** - Stop publishing exports on a world-readable URL—serve downloads through an authenticated route and keep objects in a private prefix until then, **or** - Document that must stay short and treat as sensitive (weak on its own). ### Details ## Technical details in builds the name and publishes it: The admin UI sends as the module name (e.g. ), which matches the filename. The download URL is only shown in the exporter’s notification; nothing binds the HTTP request to that us

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @apostrophecmsversion unspecified
  • npm @apostrophecms/import-export< 3.7.1

How to fix CVE-2026-112953

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-112953. EPSS is 0.56%. Act only if a listed version of ApostropheCMS is an open-source is installed.

Which versions are affected?

Compare what you have installed with < 3.7.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information. EPSS 0.56%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 20, 2026 · NIST NVD

    Detected

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private u

  2. Oct 20, 2026 · NIST NVD

    Updated

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private u

  3. Oct 20, 2026 · NIST NVD

    Updated

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private u

  4. Oct 21, 2026 · GitHub Advisory Database

    Updated

    ## Summary When a user exports content through , the module copies the generated archive into uploadfs at and returns a public URL under . The filename is fully deterministic: site , document type, a timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minute

Sources

  • CVE.orgVulnerability recordCVE-2026-112953

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-112953

    30-day exploitation probability 0.56%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-5gc8-frw3-3vqm

    ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-112953

    When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-112953

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expire

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 6, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • GitHub Advisory DatabaseOct 22, 2026
  • CVE.orgOct 21, 2026
  • NIST NVDOct 21, 2026