---
id: CVE-2026-112955
title: 'ApostropheCMS: Import archives can exhaust server storage and deny service'
summary: >-
  ApostropheCMS is an open-source Node.js content management system. Prior to
  3.7.1 of the import-export module, an authenticated importer can submit
  archives whose decompressed bytes, entry count, and entry sizes are not
  bounded before do…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
vendor: apostrophecms
product: apostrophe
affected:
  - apostrophe < 4.34.0
  - import-export < 3.7.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T19:26:22.998396Z'
published: '2026-10-20'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T19:38:31.127Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112955'
references:
  - url: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72
    label: >-
      https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498
  - url: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
    label: >-
      https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea
  - url: >-
      https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
    label: >-
      https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-112955'
  - url: 'https://github.com/advisories/GHSA-9g7p-m758-rp72'
tags:
  - cve.org
  - ghsa
  - npm
epss: 0.00525
epssPercentile: 0.44337
aliases:
  - GHSA-9g7p-m758-rp72
ecosystem: npm
patched:
  - '@apostrophecms/import-export 3.7.1'
ingestedAt: '2026-10-20T16:10:53.291Z'
---

## Overview

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.

## Affected

- `apostrophe < 4.34.0`
- `import-export < 3.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-112955)

Affected packages:

- `@apostrophecms/import-export < 3.7.1`

Patched in:

- `@apostrophecms/import-export 3.7.1`

Source: https://github.com/advisories/GHSA-9g7p-m758-rp72