What’s Vulnerable › Products

@apostrophecms import-export vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your @apostrophecms import-export version is affected

Latest @apostrophecms import-export vulnerabilities

• CVE-2026-113711 — ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5)
• CVE-2026-113664 — ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test (CVSS 5.3)
• CVE-2026-113662 — ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document (CVSS 5.4)
• CVE-2026-113649 — ApostropheCMS: Import API bypasses publication roles for protected content (CVSS 6.5)
• CVE-2026-113648 — ApostropheCMS: Missing Authentication in `cleanExport` Route (CVSS 3.1)
• CVE-2026-112955 — ApostropheCMS: Import archives can exhaust server storage and deny service (CVSS 6.5)
• CVE-2026-112953 — ApostropheCMS: Exposure of Sensitive Information via predictable export filenames (CVSS 6.0)
• CVE-2026-32731 — ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction (CVSS 9.9)