CVE-2026-112953

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.

Summary

When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token.

Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises importExport.export.expiration). That is a different model from attachment URLs, which rely on hard-to-guess IDs.

Sites that disable export, store uploads on a private backend with no anonymous read, or serve /uploads only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout.

Import-only workflows and imports themselves are out of scope; this is specific to the export download URL.

Affected configurations

All of the following must apply:

1. The @apostrophecms/import-export module is enabled and export is allowed for at least one page or piece type, and
2. Export files are served the usual way: copyIn to /exports/… and delivery via the public uploads URL (default local uploadfs or any deployment that exposes the same path without per-file auth).

If export is turned off per type or globally, or /uploads is not world-readable, an anonymous attacker cannot pull the file over HTTP—but a co-resident attacker with filesystem or bucket listing access would still see guessable names.

Remediation

• Put a high-entropy component in the export filename (e.g. apos.util.generateId()), or
• Stop publishing exports on a world-readable URL—serve downloads through an authenticated route and keep objects in a private prefix until then, or
• Document that importExport.export.expiration must stay short and treat /uploads/exports/ as sensitive (weak on its own).

Details

Technical details

exportFile() in packages/import-export/lib/methods/export.js builds the name and publishes it:

const date = dayjs().format('YYYYMMDDHHmmss');
const filename = `${self.apos.shortName}-${req.body.type.toLowerCase()}-export-${date}${format.extension}`;
const downloadPath = path.join('/exports', filename);
await copyIn(filepath, downloadPath);

The admin UI sends type as the module name (e.g. article), which matches the filename. The download URL is only shown in the exporter’s notification; nothing binds the HTTP request to that user afterward. After expiration (default 1000 * 60 * 10 ms) a timer deletes the object from uploadfs, which limits exposure but leaves a brute-forceable window.

Proof of concept

The script boots a minimal Apostrophe app with import-export, performs an export as the task user, then downloads the same archive without a session—first by path guessing, then with raw fetch. It exits non-zero on failure.

Requirements: Node 18+, pnpm install at the monorepo root (so apostrophe and @apostrophecms/import-export resolve). Set APOSTROPHE_ROOT to the checkout path.

#!/usr/bin/env bash
set -euo pipefail

# --- config ---
APOSTROPHE_ROOT="${APOSTROPHE_ROOT:-}"
if [[ -z "${APOSTROPHE_ROOT}" || ! -f "${APOSTROPHE_ROOT}/packages/import-export/package.json" ]]; then
  echo "Set APOSTROPHE_ROOT to your apostrophe monorepo checkout." >&2
  exit 1
fi

export APOS_TEST_DB_PROTOCOL=sqlite
cd "${APOSTROPHE_ROOT}/packages/import-export"

# --- run embedded PoC (no extra repo files) ---
node <<'NODE'
const assert = require('node:assert/strict');
const path = require('node:path');
const dayjs = require('dayjs');
const t = require('apostrophe/test-lib/util.js');

(async () => {
  let apos;
  const shortName = 'poc-export-site';
  const exportsPath = (root) => path.join(root, 'public/uploads/exports');

  try {
    apos…

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.

Summary

When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the format extension. There is no secret token.

Anyone who can guess that path can download the archive with a normal unauthenticated HTTP GET while the file is still present (10 minutes by default, longer if the site raises importExport.export.expiration). That is a different model from attachment URLs, which rely on hard-to-guess IDs.

Sites that disable export, store uploads on a private backend with no anonymous read, or serve /uploads only behind authentication are not hit by the network download step—but the predictable naming is still a design flaw for the default local/public uploadfs layout.

Import-only workflows and imports themselves are out of scope; this is specific to the export download URL.

Affected configurations

All of the following must apply:

1. The @apostrophecms/import-export module is enabled and export is allowed for at least one page or piece type, and
2. Export files are served the usual way: copyIn to /exports/… and delivery via the public uploads URL (default local uploadfs or any deployment that exposes the same path without per-file auth).

If export is turned off per type or globally, or /uploads is not world-readable, an anonymous attacker cannot pull the file over HTTP—but a co-resident attacker with filesystem or bucket listing access would still see guessable names.

Remediation

• Put a high-entropy component in the export filename (e.g. apos.util.generateId()), or
• Stop publishing exports on a world-readable URL—serve downloads through an authenticated route and keep objects in a private prefix until then, or
• Document that importExport.export.expiration must stay short and treat /uploads/exports/ as sensitive (weak on its own).

Details

Technical details

exportFile() in packages/import-export/lib/methods/export.js builds the name and publishes it:

const date = dayjs().format('YYYYMMDDHHmmss');
const filename = `${self.apos.shortName}-${req.body.type.toLowerCase()}-export-${date}${format.extension}`;
const downloadPath = path.join('/exports', filename);
await copyIn(filepath, downloadPath);

The admin UI sends type as the module name (e.g. article), which matches the filename. The download URL is only shown in the exporter’s notification; nothing binds the HTTP request to that user afterward. After expiration (default 1000 * 60 * 10 ms) a timer deletes the object from uploadfs, which limits exposure but leaves a brute-forceable window.

Proof of concept

The script boots a minimal Apostrophe app with import-export, performs an export as the task user, then downloads the same archive without a session—first by path guessing, then with raw fetch. It exits non-zero on failure.

Requirements: Node 18+, pnpm install at the monorepo root (so apostrophe and @apostrophecms/import-export resolve). Set APOSTROPHE_ROOT to the checkout path.

#!/usr/bin/env bash
set -euo pipefail

# --- config ---
APOSTROPHE_ROOT="${APOSTROPHE_ROOT:-}"
if [[ -z "${APOSTROPHE_ROOT}" || ! -f "${APOSTROPHE_ROOT}/packages/import-export/package.json" ]]; then
  echo "Set APOSTROPHE_ROOT to your apostrophe monorepo checkout." >&2
  exit 1
fi

export APOS_TEST_DB_PROTOCOL=sqlite
cd "${APOSTROPHE_ROOT}/packages/import-export"

# --- run embedded PoC (no extra repo files) ---
node <<'NODE'
const assert = require('node:assert/strict');
const path = require('node:path');
const dayjs = require('dayjs');
const t = require('apostrophe/test-lib/util.js');

(async () => {
  let apos;
  const shortName = 'poc-export-site';
  const exportsPath = (root) => path.join(root, 'public/uploads/exports');

  try {
    apos…