ApostropheCMS CVE-2026-112953

Exploitable only when ApostropheCMS is configured with the import-export feature enabled AND export/upload storage is publicly readable (sites with exports disabled, private upload storage, or authenticated upload delivery are NOT exposed). A user holding export permission must first have created an export archive; the attacker then leverages the predictable archive filename to fetch it over the network. The window is bounded - the archive must still exist (not yet expired or removed). These conditions (dependency on a pre-created export, non-default public-storage deployment, and a timing window) are reflected in the CVSS 4.0 AT:P and UI:P metrics and meaningfully reduce real-world exploitability.

This is a genuine but conditional information-disclosure issue (CWE-200) rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N) scores 6.0 (Medium): network-reachable and unauthenticated (PR:N), high confidentiality impact (VC:H) but no integrity or availability impact, and critically AT:P plus UI:P - meaning exploitation depends on a precondition outside the attacker's control (a privileged user must have already created an export) and on passive user action. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent: a moderate-severity confidentiality leak that is only reachable in a specific configuration. The main limiting factors are that exports must be enabled, upload storage must be publicly readable (sites using private storage or authenticated delivery are not exposed), an export must exist, and the attacker must act within the archive's expiry window. Net: real and worth patching, but not a drop-everything priority absent exploitation data.

On an ApostropheCMS site that uses publicly readable export storage, an authorized editor generates a content export via the import-export module, which is written to storage under a predictable filename. An unauthenticated attacker who can guess or derive that filename requests the archive over the network and downloads another user's exported content before it expires or is purged. No public exploit code was identified in the provided data.