import-export vulnerabilities

2 known vulnerabilities in import-export from Apostrophecms. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  apostrophe: Uncontrolled Resource Consumption

  CVE-2026-113711Oct 20, 2026Apostrophecms

  ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perfor

• 9.9 Critical severity

  import-export: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-32731Mar 18, 2026Apostrophecms

  ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of `@apostrophecms/import-export`, The `extract()` function in `gzip.js` constructs file-write paths using `fs.createWriteStream(path.join(exportPath, header.name))`. `path.jo