CVE-2026-113652: apostrophecms apostrophe
Vulnerability summary
CVE-2026-113652 is a medium (CVSS 5.6) vulnerability in apostrophecms apostrophe. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17% of scored vulnerabilities.
Timeline
- 20-10-2026PublishedVulnerability first disclosed.
- 21-10-2026Last modifiedVulnerability information updated.
Description
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.6MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · NpmEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Apostrophecms2 products
- apostrophe< 4.33.0
- uploadfs≥ 1.25.0, < 1.28.0
Npm1 product
- uploadfs≥ 1.25.0, < 1.28.0
2 vendors · 3 products