Insufficiently Protected Credentials Affecting uploadfs package, versions >=1.25.0 <1.28.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-UPLOADFS-21369583
- published21 Oct 2026
- disclosed20 Oct 2026
- creditKimi Security Team
Introduced: 20 Oct 2026
NewCVE-2026-113652 (opens in a new tab)How to fix?
Upgrade uploadfs to version 1.28.0 or higher.
Overview
uploadfs is a Store files in a web-accessible location via a simplified API. Can automatically scale and rotate images. Includes S3, Azure and local filesystem-based backends with the most convenient features of each.
Affected versions of this package are vulnerable to Insufficiently Protected Credentials via createContainer() in the Azure backend when the sas: true option is enabled. The function builds a BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. An attacker who can observe or intercept the constructed URL can extract the embedded SAS token and use it to perform unauthorized read or write operations against the configured Azure Blob Storage container.
Note: This is only exploitable when uploadfs is configured with the Azure backend and sas: true, a configuration introduced in uploadfs 1.25.0.