An unauthenticated requester can download another user's export archive from publicly readable storage because the export filenames are predictable. The exploitation allows an attacker to gain access to potentially sensitive data contained in the export. The vulnerability originates from the import-export module before version 3.7.1 and results in a data confidentiality breach.

Vulnerable packages include the import-export module (@apostrophecms:import-export) and the core ApostropheCMS software (@apostrophecms:apostrophe). Systems running any version of the import-export module older than 3.7.1 are affected. The issue was addressed and fixed in the 3.7.1 release.

With a CVSS score of 6, the vulnerability carries a moderate risk rating. Because the attack vector requires no authentication and only the ability to request a predictable file name, an attacker can execute the exploit from any network location that can reach the export storage. EPSS is not available, and the CVE is not listed in CISA's KEV, but the potential for sensitive data exposure and the ease of exploitation make it a notable concern, especially for sites that expose export storage publicly and enable exports.