CVE-2026-113652

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions 1.25.0 through 1.27.0

Description When the uploadfs component is configured with the Azure backend and the sas variable is set to true, the createContainer() function builds the BlobServiceClient using a URL that includes the full Shared Access Signature (SAS) query string. Because Azure SDK v12 derived clients inherit this query string, the getUrl() function returns a base URL containing the complete account or container SAS signature. This signature is then prepended to every public attachment link via the attachment.url() function and sent to editor sessions through getBrowserData(). This results in the exposure of container-level SAS credentials (often granting read, write, delete, and list permissions) to all site visitors, including anonymous users. An attacker with this token can read, overwrite, delete, and list every blob within the container for the duration of the SAS lifetime. This issue is caused by the reuse of a credential-bearing client URL as the public base URL.

Recommendations Update ApostropheCMS to version 1.28.0. As a temporary mitigation, avoid setting the sas variable to true when using the Azure backend in uploadfs until the update is applied.