ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
影響: npm:@apostrophecms/import-export < 3.7.1 → 3.7.1
When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if…
| CVE | CVE-2026-112953 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 05:20 |
| 데이터 | Markdown JSON |
2026. 10. 22. 오전 04:45, GitHub Advisory Database에서 "ApostropheCMS: Exposure of Sensitive Information via predictable export filenames"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-112953.