CVE-2026-112955Medium· 6.5▾ SunlitApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before do…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.
apostrophe < 4.34.0import-export < 3.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113648Low· 3.1ApostropheCMS: Missing Authentication in `cleanExport` Route
CVE-2026-113649Medium· 6.5ApostropheCMS: Import API bypasses publication roles for protected content
CVE-2026-112953Medium· 6.0ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
CVE-2026-112956Medium· 6.5ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
CVE-2026-112957Medium· 4.3ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
CVE-2026-113650Medium· 5.3ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)