ApostropheCMS: Missing Authentication In `cleanExport` Route

1. Summary The API endpoint "POST /api/v1/@apostrophecms/import-export/clean-export" in "@apostrophecms/import-export" lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

ApostropheCMS: Archive Duplicate Continuation Lets Contributors Overwrite Published Content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Import Archives Can Exhaust Server Storage And Deny Service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Import API Bypasses Publication Roles For Protected Content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

Summary When a user exports content through @apostrophecms/import-export, the module copies the generated archive into uploadfs at /exports/ and returns a public URL under /uploads/exports/. The filename is fully deterministic: site shortName, document type, a YYYYMMDDHHmmss timestamp, and the...

ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

GHSA-RW26-WWFC-9WVM ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

EUVD-2026-105172

ApostropheCMS: Missing Authentication in cleanExport Route...

ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-5M22-7PFQ-VP65 ApostropheCMS: Import API bypasses publication roles for protected content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-JF5H-36MG-RP6X ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Import archives can exhaust server storage and deny service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

GHSA-9G7P-M758-RP72 ApostropheCMS: Import archives can exhaust server storage and deny service

Review scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/[email protected], commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce September 30, 2026. Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip...

ApostropheCMS: Unauthenticated Resource Exhaustion Via Pre-auth AposBigUpload Processing In @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by "@apostrophecms/import-export". The affected import API routes invoke: "self.apos.http.bigUploadMiddleware" before the actual import handler performs its authentication check...

GHSA-86WM-68PQ-5JWQ ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

npm: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

npm: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

Allocation of Resources Without Limits or Throttling

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling which allows an unauthenticated remote attacker to create server-side upload state, write chunk data to...

Allocation of Resources Without Limits or Throttling

Overview @apostrophecms/import-export is an Import Export Documents for ApostropheCMS Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the import-export module, where an authenticated attacker can send a request that causes the server to...