Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-112955 · GHSA-9g7p-m758-rp72

ApostropheCMS: Import archives can exhaust server storage and deny service

Risk score
53/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.5%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging an…
Affected
@apostrophecms/import-export (npm) < 3.7.1
Fix
Upgrade @apostrophecms/import-export to 3.7.1 or later.
Exploitation
No known exploitation

Story map

Story map: @apostrophecms/import-exportTHE FLAWSTHE FIXCVE-2026-112955ApostropheCMS: Importarchives can exhaust serverstorage and deny serviceCVSS 6.5 · EPSS 1%CVE-2026-112953ApostropheCMS: Exposure ofSensitive Information viapredictable export filenamesCVSS 6.0 · EPSS 1%CVE-2026-112956ApostropheCMS: Archiveduplicate continuation letscontributors overwrite…CVSS 6.5 · EPSS 0%CVE-2026-113649ApostropheCMS: Import APIbypasses publication roles forprotected contentCVSS 6.5 · EPSS 0%Upgrade…3.7.1or later on your release lineWho is exposed@apostrophecms/import-export (npm) < 3.7.1YELLOW · PLAN IT IN@apostrophecms/import-exportApostropheCMS is anopen-source Node.js contentmanagement system. Prior to3.7.1 of the import-exportmodule, predictable exportarchive filenames allow anunauthenticated requester to…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-400)257 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@apostrophecms/import-export: Yellow, plan it in. ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export per…

The flaws

  • CVE-2026-112955: ApostropheCMS: Import archives can exhaust server storage and deny service (CVSS 6.5 · EPSS 1%)
  • CVE-2026-112953: ApostropheCMS: Exposure of Sensitive Information via predictable export filenames (CVSS 6.0 · EPSS 1%)
  • CVE-2026-112956: ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content (CVSS 6.5 · EPSS 0%)
  • CVE-2026-113649: ApostropheCMS: Import API bypasses publication roles for protected content (CVSS 6.5 · EPSS 0%)

The fix

Upgrade @apostrophecms/import-export: 3.7.1 or later on your release line

Who is exposed: @apostrophecms/import-export (npm) < 3.7.1

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@apostrophecms/import-exportnpm< 3.7.13.7.1

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.

Last activity 20 Oct 2026. Patch Forecast updates every hour.