https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 23:59:19 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112953 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user&#39;s export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user&#39;s export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112953 https://db.gcve.eu/vuln/ghsa-5gc8-frw3-3vqm <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>## Summary</p> <p>When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` and returns a public URL under `/uploads/exports/`. The filename is fully deterministic: site `shortName`, document type, a `YYYYMMDDHHmmss` timestamp, and the format extension. There is no secret token.</p> <p>Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises `importExport.export.expiration`). That is a different model from attachment URLs, which rely on hard-to-guess IDs.</p> <p>Sites that disable export, store uploads on a private backend with no anonymous read, or serve `/uploads` only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout.</p> <p>Import-only workflows and imports themselves are out of scope; this is specific to the export download URL.</p> <p>## Affected configurations</p> <p>All of the following must apply:</p> <p>1. The `@apostrophecms/import-export` module is enabled and export is allowed for at least one page or piece type, **and** 2. Export files are served the usual way: `copyIn` to `/exports/…` and delivery via the public `uploads` URL (default local uploadfs or any deployment that exposes the same path without per-file auth).</p> <p>If export is turned off per type or globally, or `/uploads` is not world-readable,…</p> <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>## Summary</p> <p>When a user exports content through `@apostrophecms/import-export`, the module copies the generated archive into uploadfs at `/exports/` and returns a public URL under `/uploads/exports/`. The filename is fully deterministic: site `shortName`, document type, a `YYYYMMDDHHmmss` timestamp, and the format extension. There is no secret token.</p> <p>Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises `importExport.export.expiration`). That is a different model from attachment URLs, which rely on hard-to-guess IDs.</p> <p>Sites that disable export, store uploads on a private backend with no anonymous read, or serve `/uploads` only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout.</p> <p>Import-only workflows and imports themselves are out of scope; this is specific to the export download URL.</p> <p>## Affected configurations</p> <p>All of the following must apply:</p> <p>1. The `@apostrophecms/import-export` module is enabled and export is allowed for at least one page or piece type, **and** 2. Export files are served the usual way: `copyIn` to `/exports/…` and delivery via the public `uploads` URL (default local uploadfs or any deployment that exposes the same path without per-file auth).</p> <p>If export is turned off per type or globally, or `/uploads` is not world-readable,…</p> https://db.gcve.eu/vuln/ghsa-5gc8-frw3-3vqm