CVE-2026-113652mediumCWE-200CWE-522

CVE-2026-113652: fallo de gravedad media en apostrophecms apostrophe

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ApostropheCMS+ Monitorear uploadfs

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.6epss 0.3%
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
apostrophecms · apostropheapostrophecms · uploadfs
CVEs relacionadas — apostrophecms apostrophe

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-113711HIGHApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportEPSS 0.6%CVE-2026-112953MEDIUMApostropheCMS: Exposure of Sensitive Information via predictable export filenamesEPSS 0.6%CVE-2026-112955MEDIUMApostropheCMS: Import archives can exhaust server storage and deny serviceEPSS 0.5%CVE-2026-33888MEDIUMApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APIEPSS 0.5%CVE-2026-113664MEDIUMApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testEPSS 0.5%