@apostrophecms import-export
8 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-113711 | < 3.7.0 | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export | HIGH 7.5 | 0.6 % | ||
| CVE-2026-113664 | < 3.7.0 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-113662 | < 3.7.0 | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-113649 | < 3.7.1 | ApostropheCMS: Import API bypasses publication roles for protected content | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-113648 | < 3.7.1 | ApostropheCMS: Missing Authentication in `cleanExport` Route | LOW 3.1 | 0.3 % | ||
| CVE-2026-112955 | < 3.7.1 | ApostropheCMS: Import archives can exhaust server storage and deny service | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-112953 | < 3.7.1 | ApostropheCMS: Exposure of Sensitive Information via predictable export filenames | MEDIUM 6.0 | 0.6 % | ||
| CVE-2026-32731 | < 3.5.3 | ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction | CRITICAL 10.0 | 0.5 % |