Predictable Filename Vulnerability in ApostropheCMS Import-Export Module

CVE-2026-112953

What is CVE-2026-112953?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability in its import-export module prior to version 3.7.1. This issue arises from predictable export archive filenames which can be exploited by unauthenticated users, allowing them to download another user's export from publicly accessible export storage. This vulnerability is particularly concerning in environments where exports are enabled. To mitigate this risk, users are encouraged to upgrade to version 3.7.1 or later, which addresses this security flaw.

References