## ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-112953
- 公開日時: 2026-10-21T19:45:03.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-5gc8-frw3-3vqm)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-5gc8-frw3-3vqm

影響: npm:@apostrophecms/import-export < 3.7.1 → 3.7.1
Summary When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if…