{"id":"ghsa-ghsa-5gc8-frw3-3vqm","seq":53435,"kind":"advisory","title":"ApostropheCMS: Exposure of Sensitive Information via predictable export filenames","url":"https://github.com/advisories/GHSA-5gc8-frw3-3vqm","permalink":"https://vulnpulse.app/items/ghsa-ghsa-5gc8-frw3-3vqm","summary":"影響: npm:@apostrophecms/import-export < 3.7.1 → 3.7.1\nSummary When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112953"],"tags":["GHSA-5gc8-frw3-3vqm","@apostrophecms/import-export"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T19:45:03.000Z","fetched_at":"2026-10-21T20:20:51.598Z"}