CVE-2026-112953: ApostropheCMS Predictable Export Filenames Lead to Sensitive Information Exposure
Summary
CVE-2026-112953: ApostropheCMS: Exposure of Sensitive Information via predictable export filenames. Affects @apostrophecms/import-export versions < 3.7.1. Fixed in 3.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system designed for building websites and applications. It allows users to create, manage, and publish content easily. The '@apostrophecms/import-export' module facilitates the export of content, but it has a vulnerability that exposes sensitive information through predictable export filenames, allowing unauthorized access to exported files.
Vulnerability Detail
The vulnerability arises from the predictable naming convention used for exported files in the '@apostrophecms/import-export' module. When content is exported, the filenames are generated using a deterministic pattern based on the site's short name, document type, and a timestamp. This allows anyone who can guess the URL to download the exported files without authentication, potentially exposing sensitive content to unauthorized users. The lack of a secret token further exacerbates this issue, making it easy for attackers to exploit the vulnerability.
How To Fix
Latest published version: 3.7.1 as of 22 Oct 2026
npm install @apostrophecms/import-export@3.7.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement one of the following strategies: 1. Introduce a high-entropy component in the export filename using a function like 'apos.util.generateId()' to make the filenames less predictable. 2. Serve exported files through an authenticated route instead of a public URL, ensuring that only authorized users can access them. 3. Keep the 'importExport.export.expiration' setting short and treat the '/uploads/exports/' directory as sensitive.
Conclusion
The CVE-2026-112953 vulnerability in the '@apostrophecms/import-export' module poses a risk of sensitive information exposure due to predictable export filenames. It is crucial to update to the latest version to mitigate this risk and consider implementing workarounds in the interim.
See every vulnerability recorded for @apostrophecms/import-export →
FAQ
An unauthenticated remote party can download sensitive export files that were meant for authorized users, compromising the confidentiality of the content.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement the suggested workarounds to mitigate the risk until you can update to the patched version.
This specific vulnerability is isolated to the '@apostrophecms/import-export' module and does not affect other modules directly.
The CVSS score for this vulnerability is 6.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @apostrophecms/import-export.
