CVE-2026-113652mediumCWE-200CWE-522

CVE-2026-113652: falha de média gravidade em apostrophecms apostrophe

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ApostropheCMS+ Monitorar uploadfs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.6epss 0.3%
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
apostrophecms · apostropheapostrophecms · uploadfs
CVEs relacionadas — apostrophecms apostrophe

No mesmo produto, das mais perigosas para as menos.

CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-113711HIGHApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportEPSS 0.6%CVE-2026-112953MEDIUMApostropheCMS: Exposure of Sensitive Information via predictable export filenamesEPSS 0.6%CVE-2026-112955MEDIUMApostropheCMS: Import archives can exhaust server storage and deny serviceEPSS 0.5%CVE-2026-33888MEDIUMApostropheCMS: publicApiProjection Bypass via `project` Query Builder in Piece-Type REST APIEPSS 0.5%CVE-2026-113664MEDIUMApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testEPSS 0.5%