ApostropheCMS UploadFS CVE-2026-113652

Exploitable ONLY when uploadfs is configured with the Azure backend AND the sas: true option is set; in that mode createContainer() builds the BlobServiceClient from a URL embedding the full SAS query string, and all Azure SDK v12 derived clients inherit it, so the account-level SAS token is written into every public attachment URL. No authentication or user interaction is needed to harvest the token - any publicly reachable attachment URL exposes it. LIMITING FACTORS: deployments not using the Azure backend, or using it without sas: true, are unaffected; the blast radius depends on the SAS token's permission scope and expiry, and remediation requires upgrading uploadfs to 1.28.0 AND rotating/revoking the already-exposed SAS token.

The vendor CVSS of 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) treats this as a medium information-disclosure issue, but that scoring appears to UNDER-rate the real impact: the leaked secret is described as an ACCOUNT-LEVEL Azure SAS token embedded in every public attachment URL, which effectively grants broad read/write/delete access to the entire backing storage account rather than a single low-value datum - closer to C:H/I:H/A:H with a scope change (see assessed vector). AV:N and PR:N are well supported because the token is exposed to anyone who can view a public attachment URL, requiring no authentication. AC:H is justified because exploitation is gated on a non-default deployment (Azure backend with sas:true), not on attacker skill. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is no public exploit identified at time of analysis - meaning it is a configuration-conditional exposure rather than a confirmed widespread-exploitation priority. Net: for the subset of operators actually running the Azure backend with sas:true this is a HIGH-urgency credential-exposure bug; for everyone else it is not applicable. Key conflict to flag: vendor impact metrics (C:L/I:L/A:L) are inconsistent with an account-level SAS leak - verify the actual SAS permission scope with the vendor advisory GHSA-hhph-8536-gfq5.

An ApostropheCMS 1.25.0-1.27.x site is configured with the uploadfs Azure backend and sas: true, so every public attachment (images, PDFs, downloads) is served from a URL containing the full account-level SAS query string. Any unauthenticated visitor who views or scrapes one of these public URLs simply copies the embedded SAS token and can then authenticate directly against the Azure Blob storage account to list, download, overwrite, or delete arbitrary blobs. No public exploit was identified at time of analysis, but exploitation requires only reading a normal page.