CVE-2026-112953: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in apostrophecms apostrophe

CVE-2026-112953 describes an information exposure vulnerability in ApostropheCMS's import-export module before version 3.7.1. The vulnerability arises because export archive filenames are predictable, enabling an unauthenticated attacker to download export archives created by other users from publicly accessible export storage. This exposure only occurs if a user with export permission has created an export archive and if the site uses publicly readable export storage without additional protections such as private upload storage or authenticated upload delivery. The vulnerability is resolved in version 3.7.1 of the import-export module.

An unauthenticated attacker can access sensitive export archives created by other users if the site uses publicly readable export storage and exports are enabled. This could lead to unauthorized disclosure of potentially sensitive content. However, the vulnerability requires that an export archive has been created by a user with export permission, and it does not affect sites with exports disabled or those using private or authenticated upload storage. There is no indication of active exploitation in the wild.

Upgrade the import-export module to version 3.7.1 or later, where the vulnerability is fixed. Alternatively, disable exports, use private upload storage, or enable authenticated upload delivery to prevent unauthorized access to export archives. Since a fix is available, applying the official update is the recommended remediation.