CVE-2026-112955: ApostropheCMS: Import archives can exhaust server storage and deny service
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMS import-export moduleto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with importer access can submit a crafted archive. The issue is in the import-export module before version 3.7.1.
Are default protections sufficient?
No conclusion about default configuration is provided. The affected path occurs before document-type authorization, while separate pre-authentication and write-error paths were already hardened.
What should be done if patching cannot happen immediately?
Limit importer access to trusted users and restrict or suspend archive imports where practical. This reduces exposure because exploitation requires an authenticated importer to upload an archive.
How can teams determine whether they are affected?
Check whether npm/@apostrophecms/import-export is deployed at a version earlier than 3.7.1 and whether authenticated users can perform imports. Review available storage and import staging areas for residual extracted or staging artifacts following failed extraction or parsing attempts.