Vulnerability · Published Oct 20, 2026 · Assigned by GitHub_M
CVE-2026-112955ApostropheCMS: Import archives can exhaust server storage and deny service
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in apostrophe from apostrophecms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @apostrophecms/import-export | 3.7.1 | GHSA-9g7p-m758-rp72 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| apostrophecms | apostrophe | < 4.34.0 |
| @apostrophecms | import-export | < 3.7.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72 x_refsource_CONFIRM
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 x_refsource_MISC
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea x_refsource_MISC
- https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1 x_refsource_MISC