ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

影響: npm:@apostrophecms/import-export < 3.7.1 → 3.7.1

When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if…

Read on GitHub Advisory Database

On 10/22/2026, 04:45 AM, GitHub Advisory Database published "ApostropheCMS: Exposure of Sensitive Information via predictable export filenames" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-112953.