CVE-2026-113652: uploadfs Azure Backend SAS Token Exposure in ApostropheCMS
Summary
CVE-2026-113652: When uploadfs is configured with the Azure backend and sas: true (a supported configuration introduced in uploadfs 1.25.0), createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string,... Affects uploadfs versions >= 1.25.0, < 1.28.0. Fixed in 1.28.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is a content management system designed for building and managing websites with a focus on ease of use and flexibility. It utilizes the uploadfs package to handle file uploads, including integration with cloud storage services like Azure. The uploadfs package allows for efficient file management but has a critical vulnerability when configured with Azure's backend using a Shared Access Signature (SAS) token, which can inadvertently expose sensitive credentials.
Vulnerability Detail
The vulnerability arises when uploadfs is configured with the Azure backend and the SAS token is set to true. This configuration leads to the creation of a BlobServiceClient URL that includes the full SAS query string, which is then inherited by derived clients in the Azure SDK. Consequently, the getUrl() method returns a URL that contains the complete account/container SAS signature, allowing anyone who accesses an attachment URL to read, overwrite, delete, and list every blob in the container for the duration of the SAS token's validity. This issue is compounded by a functional bug that results in broken URLs, indicating that the code path was never fully tested. The vulnerability is classified under CWE-200 (Information Exposure) and CWE-522 (Insufficiently Protected Credentials).
How To Fix
Latest published version: 1.28.1 as of 22 Oct 2026
npm install uploadfs@1.28.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.28.0
This is the first release that contains the fix.
npm install uploadfs@1.28.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually construct the public URLs without including the SAS token. Use the following code snippet to achieve this:
const accountUrl = 'https://<account>.blob.core.windows.net';
const containerName = 'uploads-container';
const blobPath = 'attachments/id-name';
const publicUrl = `${accountUrl}/${containerName}/${blobPath}`; // Construct URL without SAS token
Conclusion
The vulnerability identified as CVE-2026-113652 in the uploadfs package of ApostropheCMS poses a significant risk by exposing sensitive SAS tokens through public URLs. It is crucial for users to update to the latest version to mitigate this risk and implement the suggested workarounds if immediate updates are not feasible.
See every vulnerability recorded for uploadfs →
FAQ
A SAS (Shared Access Signature) token is a secure way to grant limited access to Azure storage resources without exposing your account key.
If your site uses uploadfs with Azure and has the SAS token enabled, it can expose sensitive credentials, allowing unauthorized users to access and manipulate your storage.
Implement the provided workaround to manually construct public URLs without the SAS token until you can update to the patched version.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities in real-time.
The exposure of a container-level SAS token can lead to unauthorized access to all blobs in the container, allowing attackers to read, overwrite, delete, and list files.
References
Related vulnerabilities
Recent vulnerabilities recorded for uploadfs.
