https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-22T23:59:17.005671+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-112953 fkie_cve-2026-112953 2026-10-22T23:59:17.024297+00:00

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.

 https://db.gcve.eu/vuln/ghsa-5gc8-frw3-3vqm GHSA-5gc8-frw3-3vqm — ApostropheCMS: Exposure of Sensitive Information via predictable export filenames 2026-10-22T23:59:17.024403+00:00

Affected: npm: @apostrophecms/import-export

## Summary

When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` and returns a public URL under `/uploads/exports/`. The filename is fully deterministic: site `shortName`, document type, a `YYYYMMDDHHmmss` timestamp, and the format extension. There is no secret token.

Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises `importExport.export.expiration`). That is a different model from attachment URLs, which rely on hard-to-guess IDs.

Sites that disable export, store uploads on a private backend with no anonymous read, or serve `/uploads` only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout.

Import-only workflows and imports themselves are out of scope; this is specific to the export download URL.

## Affected configurations

All of the following must apply:

1. The `@apostrophecms/import-export` module is enabled and export is allowed for at least one page or piece type, **and** 2. Export files are served the usual way: `copyIn` to `/exports/…` and delivery via the public `uploads` URL (default local uploadfs or any deployment that exposes the same path without per-file auth).

If export is turned off per type or globally, or `/uploads` is not world-readable,…