CVE-2026-112953 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments, particularly those using the @apostrophecms/import-export module, should assess exposure and implement compensating controls to prevent unauthorized access to sensitive information.

Why it matters

Defenders should prioritize verifying exposure and implementing compensating controls for publicly accessible export files due to predictable export filenames in the @apostrophecms/import-export module.

• Verify exposure of sensitive information due to predictable export filenames.
• Implement compensating controls to restrict access to /uploads/exports/.
• Assess the impact of unauthorized access to sensitive information on the organization.
• Prioritize remediation based on the sensitivity of the exposed information.

Technical summary

The @apostrophecms/import-export module generates predictable export filenames based on site shortName, document type, timestamp, and format extension. This allows unauthorized access to sensitive information via unauthenticated HTTP GET requests. Sites that disable export, store uploads on a private backend with no anonymous read, or serve /uploads only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout. Import-only workflows and imports themselves are out of scope; this is specific to the export download URL.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for publicly accessible export files.

Recommended defensive actions

• Verify if the @apostrophecms/import-export module is enabled and export is allowed for any pages or pi.
• Check if uploads are stored on a private backend with no anonymous read or served only behind authentication.
• Implement compensating controls, such as restricting access to /uploads/exports/ or using a private backend.
• Consider upgrading to version 3.7.1 or later of the @apostrophecms/import-export module.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The source corpus provides details on the predictable export filenames generated by the @apostrophecms/import-export module. Evidence is based on official source records and supplemental references. The module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token. Anyone who can guess that path can download the archive with a normal unauth

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.