@apostrophecms import-export vulnerabilities

Newest CVEs

• CVE-2026-113711

  ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

  apostrophecms · apostrophe

  High7.5
• CVE-2026-113664

  ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-113662

  ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

  apostrophecms · apostrophe

  Medium5.4
• CVE-2026-113649

  ApostropheCMS: Import API bypasses publication roles for protected content

  apostrophecms · apostrophe

  Medium6.5
• CVE-2026-113648

  ApostropheCMS: Missing Authentication in `cleanExport` Route

  apostrophecms · apostrophe

  Low3.1
• CVE-2026-112955

  ApostropheCMS: Import archives can exhaust server storage and deny service

  apostrophecms · apostrophe

  Medium6.5
• CVE-2026-112953

  ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

  apostrophecms · apostrophe

  Medium6.0