@apostrophecms import-export

• CVE-2026-113711 High 7.5 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export 0.6%
• CVE-2026-113664 Medium 5.3 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test 0.5%
• CVE-2026-113662 Medium 5.4 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document 0.3%
• CVE-2026-113649 Medium 6.5 ApostropheCMS: Import API bypasses publication roles for protected content 0.3%
• CVE-2026-113648 Low 3.1 ApostropheCMS: Missing Authentication in `cleanExport` Route 0.3%
• CVE-2026-112955 Medium 6.5 ApostropheCMS: Import archives can exhaust server storage and deny service 0.5%
• CVE-2026-112953 Medium 6.0 ApostropheCMS: Exposure of Sensitive Information via predictable export filenames 0.6%
• CVE-2026-32731 Critical 10.0 ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction 0.5%