{"id":"EUVD-2026-105103","enisaUuid":"6b1de927-b0be-30b1-96aa-116aa53f9567","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user\u0027s export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.","datePublished":"Oct 20, 2026, 3:47:25 PM","dateUpdated":"Oct 20, 2026, 4:22:21 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5gc8-frw3-3vqm\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1\n","aliases":"CVE-2026-112953\nGHSA-5gc8-frw3-3vqm\n","assigner":"GitHub_M","epss":0.56,"enisaIdProduct":[{"id":"93ce2f3f-6782-3158-a191-c9df0a6dc107","product":{"name":"import-export","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 3.7.1"},{"id":"dfff142c-5ab7-37d8-8648-7ecd8d23666b","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"}],"enisaIdVendor":[{"id":"ba9149c5-603c-3889-b0ec-f0c1082f6f1b","vendor":{"name":"apostrophecms"}},{"id":"ebfc6b97-b62d-35b9-a240-c01d0647ee87","vendor":{"name":"@apostrophecms"}}],"enisaIdVulnerability":[{"id":"966e0c40-f920-3869-bfd0-07c0b78356c3","vulnerability":{"id":"CVE-2026-112953","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user\u0027s export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.","datePublished":"Oct 20, 2026, 3:47:25 PM","dateUpdated":"Oct 20, 2026, 4:22:21 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5gc8-frw3-3vqm\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1\n","enisa_id":"EUVD-2026-105103\n","assigner":"GitHub_M","epss":0.56,"dataProcessed":"Oct 29, 2026, 7:14:24 AM","vulnerabilityProduct":[{"id":"69661434-2efc-3e9a-a31d-7bbf17f3517c","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.34.0"},{"id":"acca833f-20e8-3d04-90c8-ae3801d246d7","product":{"name":"import-export","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 3.7.1"}],"vulnerabilityVendor":[{"id":"288a392a-3b36-30e8-857d-2ed583ddfc67","vendor":{"name":"apostrophecms"}},{"id":"c4b416f4-aafb-3f93-81de-ce640fb748c5","vendor":{"name":"@apostrophecms"}}]}},{"id":"a898ace2-e649-36f1-8e51-608eeab09b26","vulnerability":{"id":"GHSA-5gc8-frw3-3vqm","description":"ApostropheCMS: Exposure of Sensitive Information via predictable export filenames","datePublished":"Oct 21, 2026, 7:45:03 PM","dateUpdated":"Oct 21, 2026, 7:45:03 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5gc8-frw3-3vqm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112953\nhttps://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498\nhttps://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1\n","enisa_id":"EUVD-2026-105103\n","aliases":"CVE-2026-112953\nGHSA-5gc8-frw3-3vqm\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 7:03:23 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}