CVE-2026-112953 Details

A vulnerability in the ApostropheCMS import-export module, affecting versions prior to 3.7.1, allows an unauthenticated user to download another user's export archive from publicly accessible export storage. This is possible due to predictable filename generation, which includes the site's short name, document type, timestamp, and file extension. The vulnerability arises after a user with export permissions creates an archive, as the export is stored in a publicly readable location for a limited time. While the issue does not affect sites with exports disabled or those using private upload storage, the default export handling exposes a design flaw that can be exploited.

Users can update to ApostropheCMS version 3.7.1 or later, where this vulnerability has been fixed. Alternatively, exports can be kept private until delivery through an authenticated route, or the export filename can be made less predictable by using a high-entropy component.