{"id":"EUVD-2026-105180","enisaUuid":"56d434d4-1dbb-31db-85f7-96e59121e81a","description":"ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.","datePublished":"Oct 20, 2026, 4:26:21 PM","dateUpdated":"Oct 21, 2026, 3:53:38 PM","baseScore":5.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhph-8536-gfq5\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0\n","aliases":"CVE-2026-113652\nGHSA-hhph-8536-gfq5\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"6cd3db16-6346-386b-8f60-bde71bc68520","product":{"name":"uploadfs","vendor":{"name":"apostrophecms"}},"product_version":"1.25.0, \u003c 1.28.0"},{"id":"83de67a4-01a5-3560-a4e3-e6952e0ce6fe","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"enisaIdVendor":[{"id":"0dc31cca-92a9-390c-b96a-3bbfa1b995db","vendor":{"name":"apostrophecms"}}],"enisaIdVulnerability":[{"id":"14880147-d644-3e1b-915c-dea1dcd12f72","vulnerability":{"id":"GHSA-hhph-8536-gfq5","description":"ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)","datePublished":"Oct 20, 2026, 6:20:35 PM","dateUpdated":"Oct 20, 2026, 6:20:35 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhph-8536-gfq5\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0\n","enisa_id":"EUVD-2026-105180\n","aliases":"GHSA-hhph-8536-gfq5\nCVE-2026-113652\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5884bdec-dfb0-3bf2-accf-60aa7dca2de3","vulnerability":{"id":"CVE-2026-113652","description":"ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.","datePublished":"Oct 20, 2026, 4:26:21 PM","dateUpdated":"Oct 21, 2026, 3:53:38 PM","status":"PUBLISHED","baseScore":5.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-hhph-8536-gfq5\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/uploadfs@1.28.0\n","enisa_id":"EUVD-2026-105180\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Nov 2, 2026, 7:15:26 AM","vulnerabilityProduct":[{"id":"adb5e6d0-afe4-39e7-aeaa-4f188789a796","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"},{"id":"ef8673af-d7cd-362a-8c9e-8a670c33c5f6","product":{"name":"uploadfs","vendor":{"name":"apostrophecms"}},"product_version":"1.25.0, \u003c 1.28.0"}],"vulnerabilityVendor":[{"id":"ab2b7144-8082-364c-8bf5-4446c2d49df1","vendor":{"name":"apostrophecms"}}]}}],"enisaIdAdvisory":[]}