CVE-2026-113652

MediumCVSS 5.6

Published: 20/10/2026(UTC)Updated: 20/10/2026(UTC)Translated: 20/10/2026(UTC)NVD NIST

Summary

From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string.

Risk Assessment

An account-level SAS token exposed in public URLs may allow unauthorized access to Azure Storage account resources.

Recommendation

Update uploadfs to version 1.28.0 or later and revoke and regenerate any exposed SAS tokens.

Other vulnerabilities in uploadfs

CVE-2026-113651Low
In uploadfs prior to 1.28.0, attacker-controlled paths that reach the local backend can contain parent-directory segments that escape the configured upload directory and affect file reads, writes, and deletion on the host filesystem. Exploitability depends on an application exposing the relevant uploadfs operations to untrusted paths.

Original NVD description (English source)

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS