ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

影響: npm:uploadfs >= 1.25.0, < 1.28.0 → 1.28.0

When uploadfs is configured with the Azure backend and sas: true (a supported configuration introduced in uploadfs 1.25.0), createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result, getUrl() returns a base URL carrying the complete account/container SAS signature (?sv=...&sig=...), and Apostrophe's attachment.url() prepends it to every public attachment link — broadcasting a…

GitHub Advisory Database에서 읽기

2026. 10. 21. 오전 03:20, GitHub Advisory Database에서 "ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js, Microsoft Azure. CVE: CVE-2026-113652.