{"answers":{"affected":"2 open source packages ship an affected version, including uploadfs.","exploited":"There is no known exploitation of CVE-2026-113652 in the wild and no public exploit code.","fix":"Upgrade uploadfs to 1.28.0 or later.","what":"CVE-2026-113652 is a medium-severity vulnerability in apostrophecms apostrophe, published on 20 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-113652 and fix it if it is affected.\n\nWhat it is: CVE-2026-113652 is a medium-severity vulnerability in apostrophecms apostrophe, published on 20 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-113652 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- uploadfs (npm): affected from 1.25.0; fixed in 1.28.0\n- uploadfs (npm): affected from 1.25.0; fixed in 1.28.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-113652/ (Markdown: https://insights.sbomify.com/CVE-2026-113652/index.md)","id":"CVE-2026-113652","markdown":"https://insights.sbomify.com/CVE-2026-113652/index.md","name":"CVE-2026-113652","record":{"aliases":["GHSA-hhph-8536-gfq5"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":5.6,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: true, createContainer() builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. This issue is fixed in version 1.28.0.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)","id":"CVE-2026-113652","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":4,"next":{"headline":"ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)","id":"CVE-2026-113653"},"packages":[{"ecosystem":"npm","fixed":["1.28.0"],"introduced":["1.25.0"],"last_affected":[],"package":"uploadfs","purl":null,"source":"GHSA-hhph-8536-gfq5"},{"ecosystem":"npm","fixed":["1.28.0"],"introduced":["1.25.0"],"last_affected":[],"package":"uploadfs","purl":"pkg:npm/uploadfs","source":"GHSA-hhph-8536-gfq5"}],"prev":{"headline":"ApostropheCMS: Path traversal in uploadfs","id":"CVE-2026-113651"},"products":["apostrophe","uploadfs"],"published":"2026-10-20","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-21","vendors":["apostrophecms"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-113652/"}