Node.js Content Management System Vulnerability in ApostropheCMS
CVE-2026-112955
6.5MEDIUM
What is CVE-2026-112955?
ApostropheCMS, an open-source content management system built on Node.js, has a vulnerability in its import-export module prior to version 3.7.1. This issue allows authenticated importers to submit archives that lack proper limits on decompressed bytes, entry counts, and entry sizes before document-type authorization. As a result, extraction or parsing failures may leave both staging and extracted artifacts without adequate cleanup, which could potentially lead to a denial-of-service scenario. This vulnerability underscores the importance of robust validation processes and timely updates to maintain application security.
Affected Version(s)
apostrophe < 4.34.0
import-export < 3.7.1