{"id":"CVE-2026-112955","title":"ApostropheCMS: Import archives can exhaust server storage and deny service","summary":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before do…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-400"],"vendor":"apostrophecms","product":"apostrophe","affected":["apostrophe < 4.34.0","import-export < 3.7.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T19:26:22.998396Z"},"published":"2026-10-20","updated":"2026-10-26","sourceUpdated":"2026-10-26T19:38:31.127Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112955","references":[{"url":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72","label":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72"},{"url":"https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498","label":"https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498"},{"url":"https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea","label":"https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea"},{"url":"https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1","label":"https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112955"},{"url":"https://github.com/advisories/GHSA-9g7p-m758-rp72"}],"tags":["cve.org","ghsa","npm"],"epss":0.00525,"epssPercentile":0.44337,"aliases":["GHSA-9g7p-m758-rp72"],"ecosystem":"npm","patched":["@apostrophecms/import-export 3.7.1"],"ingestedAt":"2026-10-20T16:10:53.291Z","slug":"CVE-2026-112955","body":"## Overview\n\nApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.\n\n## Affected\n\n- `apostrophe < 4.34.0`\n- `import-export < 3.7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-112955)\n\nAffected packages:\n\n- `@apostrophecms/import-export < 3.7.1`\n\nPatched in:\n\n- `@apostrophecms/import-export 3.7.1`\n\nSource: https://github.com/advisories/GHSA-9g7p-m758-rp72","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}