Unsecured Upload Handling in ApostropheCMS Builds

CVE-2026-113711

What is CVE-2026-113711?

ApostropheCMS, a popular open-source Node.js content management system, has a vulnerability that affects its handling of file uploads. Specifically, prior to versions 4.33.0 and 3.7.0 of the import-export module, an issue arises where the import routes allow unauthenticated requests to trigger upload initialization processes. This results in unauthorized access for executing storage and cleanup routines before a proper user authorization check can be performed. The vulnerability has been addressed in updated versions, providing enhanced security measures for file handling.

References