CVE-2026-113652: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.28.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use the uploadfs Azure backend with sas: true and run a version from 1.25.0 through 1.28.0. The issue is fixed in version 1.28.0.
What could an attacker obtain from this issue?
Every public attachment URL can expose the full account-level Azure SAS token in its query string. An attacker who can obtain one of these public attachment URLs could recover that token.
Is a default configuration affected?
The vulnerable behavior requires the Azure backend to be configured and sas: true to be enabled. The provided information does not establish that this is the default configuration.
How can I check whether exposure has occurred?
Inspect public attachment URLs generated by the Azure uploadfs backend. Exposure is indicated if those URLs contain the account-level SAS query string.