CVE-2026-112953: ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMS import-export moduleto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated download of export archives?
The network-download path is exposed when the import-export module is affected, a user with export permission creates an archive, and export storage is publicly readable. Sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this path.
What must an attacker do to retrieve an export?
An attacker does not need authentication, but an export archive must first have been created by a user with export permission. The attacker must request the predictable archive filename before the archive expires or is removed.
What can be done if upgrading cannot happen immediately?
Disable exports, make upload storage private, or require authentication for upload delivery. These measures prevent exposure through the described unauthenticated network-download path.
What version fixes the issue?
Version 3.7.1 of @apostrophecms/import-export fixes the predictable export filename issue.