{"id":"ghsa-ghsa-hhph-8536-gfq5","seq":2411,"kind":"advisory","title":"ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)","url":"https://github.com/advisories/GHSA-hhph-8536-gfq5","permalink":"https://vulnpulse.app/items/ghsa-ghsa-hhph-8536-gfq5","summary":"影響: npm:uploadfs >= 1.25.0, < 1.28.0 → 1.28.0\nSummary When uploadfs is configured with the Azure backend and sas: true (a supported configuration introduced in uploadfs 1.25.0), createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, getUrl() returns a base URL carrying the complete account/container SAS signature (?sv=...&sig=...), and Apostrophe's attachment.url() prepends it to every public attachment link — broadcasting a…","severity":"medium","techs":["nodejs","azure"],"cves":["CVE-2026-113652"],"tags":["GHSA-hhph-8536-gfq5","uploadfs"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:20:35.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}