CVE-2026-113652 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS installations using uploadfs with Azure backend and `sas: true` should assess exposure and prioritize remediation. This includes verifying affected versions and configurations, updating uploadfs to a secure version, and reviewing compensating controls for exposed systems.

Why it matters

Defenders should care about CVE-2026-113652 because it allows unauthorized access to sensitive data, possible overwrite or deletion of blobs, and exposure of SAS tokens to anonymous site visitors. Affected ApostropheCMS installations using uploadfs with Azure backend and `sas: true` require verification and remediation.

• Potential unauthorized access to sensitive data
• Possible overwrite or deletion of blobs
• Exposure of SAS tokens to anonymous site visitors
• Need for verification of affected versions and configurations

Technical summary

The issue arises from the `createContainer()` function building the `BlobServiceClient` from a URL that embeds the full SAS query string, which is then inherited by Azure SDK v12 derived clients. As a result, `getUrl()` returns a base URL carrying the complete account/container SAS signature, and Apostrophe's `attachment.url()` prepends it to every public attachment link. This leads to unauthorized access to sensitive data, possible overwrite or deletion of blobs, and exposure of SAS tokens to anonymous site visitors.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable uploadfs configurations, especially those using Azure backend with `sas: true`.

Recommended defensive actions

• Verify if uploadfs is configured with Azure backend and `sas: true`
• Update uploadfs to version 1.28.0 or later
• Review and update attachment URLs to prevent exposure of SAS tokens
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is verified at commit `5a3746aaed49761e171c2cbfe793267c959829fd` (uploadfs 1.27.0 in the apostrophe monorepo). This verification was done through a detailed review of the uploadfs codebase and Azure backend configuration. The vulnerability is confirmed to exist in uploadfs versions prior to 1.28.0. Defenders should verify their installations and configurations to assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.