Apostrophecms Import-export vulnerabilities

• @apostrophecms import-export, apostrophecms apostrophe +1 more ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export CVE-2026-113711 Fix available 7.5 HighOctober 20, 2026
• @apostrophecms import-export, apostrophecms apostrophe +1 more ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test CVE-2026-113664 Fix available 5.3 MediumOctober 20, 2026
• @apostrophecms import-export, apostrophecms apostrophe +1 more ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document CVE-2026-113662 Fix available 5.4 MediumOctober 20, 2026
• @apostrophecms import-export, apostrophecms apostrophe +1 more ApostropheCMS: Import API bypasses publication roles for protected content CVE-2026-113649 Fix available 6.5 MediumOctober 20, 2026
• @apostrophecms import-export, apostrophecms apostrophe +1 more ApostropheCMS: Missing Authentication in `cleanExport` Route CVE-2026-113648 Fix available 3.1 LowOctober 20, 2026
• @apostrophecms import-export, apostrophecms apostrophe +1 more ApostropheCMS: Import archives can exhaust server storage and deny service CVE-2026-112955 Fix available 6.5 MediumOctober 20, 2026
• @apostrophecms import-export, apostrophecms apostrophe +1 more ApostropheCMS: Exposure of Sensitive Information via predictable export filenames CVE-2026-112953 Fix available 6.0 MediumOctober 20, 2026
• apostrophecms import-export ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVE-2026-32731 Public exploitFix available 10.0 CriticalMarch 18, 2026