{"id":"EUVD-2026-105105","revision":null,"records":[{"revision":"808b602251684a788695111a62775b53","observedAt":"2026-10-26T20:35:31.018+00:00","statement":{"source":"cve-program","id":"CVE-2026-112955","aliases":[],"title":"ApostropheCMS: Import archives can exhaust server storage and deny service","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.","state":0,"publishedAt":"2026-10-20T15:53:04.154+00:00","modifiedAt":"2026-10-26T19:38:31.127+00:00","affected":[{"ecosystem":"Vendor product","name":"apostrophe","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"apostrophecms\",\n                    \"product\": \"apostrophe\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.34.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"import-export","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@apostrophecms\",\n                    \"product\": \"import-export\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.7.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72","https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498","https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112955","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-112955","identifiers":["CVE-2026-112955"]},"retained":false,"historicalAffected":[]},{"revision":"ba22b77e45e244d6919cab7d913bb866","observedAt":"2026-11-01T02:13:10.454+00:00","statement":{"source":"euvd","id":"EUVD-2026-105105","aliases":["CVE-2026-112955","GHSA-9g7p-m758-rp72"],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before docum…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72","https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498","https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105105","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 3:53:04 PM","dateUpdated":"Oct 26, 2026, 7:38:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105105","identifiers":["EUVD-2026-105105","CVE-2026-112955","GHSA-9g7p-m758-rp72"]},"retained":false,"historicalAffected":[]},{"revision":"7c915fbfe51d4ce1b1361fc24c4d81f4","observedAt":"2026-10-27T06:23:14.617+00:00","statement":{"source":"nvd","id":"CVE-2026-112955","aliases":[],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before docum…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.","state":0,"publishedAt":"2026-10-20T16:17:06.503+00:00","modifiedAt":"2026-10-26T20:17:49.117+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498","https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-112955","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-400"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T16:17:06.503","lastModified":"2026-10-26T20:17:49.117"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-112955","identifiers":["CVE-2026-112955"]},"retained":false,"historicalAffected":[]},{"revision":"7203d5bf3ce24723b18db394bb8ee681","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-9g7p-m758-rp72","aliases":["CVE-2026-112955"],"title":"ApostropheCMS: Import archives can exhaust server storage and deny service","description":"## Review scope and evidence limits\n\nPackage: @apostrophecms/import-export, version 3.7.0.\n\nRelease tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).\n\nCurrent main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.\n\nThe importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.\n\n## Import archive extraction lacks resource quotas and failure cleanup\n\nThe current gzip extractor handles destination write errors and waits for write completion; those parts of the original report should no longer be treated as unchanged. The import routes also now require a logged-in user before big-upload processing, as covered by GHSA-86wm-68pq-5jwq.\n\nHowever, extract() still writes expanded archive entries without per-entry, aggregate decompressed-byte, or entry-count quotas. Archive parsing still precedes document-type authorization. If extraction or parsing fails, import() notifies and rethrows before the later storage.remove() call, with no unconditional cleanup around that lifecycle. The reported residual risk is excessive storage consumption and retained extraction/staging artifacts from authenticated imports. Handling a write error and requiring login do not enforce a storage budget.\n\nSuggested remediation: add configurable streaming quotas based on actual decompressed bytes, cap entries and allowed entry types, bound concurrent imports, and clean local and uploadfs artifacts on every failure. Retain continuation artifacts only under explicit ownership, expiry and total-storage limits.\n\nSource references:\n- [Gzip extractor](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/formats/gzip.js)\n- [Import lifecycle and cleanup](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js)\n- [Related authentication fix](https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-86wm-68pq-5jwq)\n\n## Coordination\n\nVivek R / Winfunc\nOriginal reporting team: Mufeed VH / Winfunc","state":0,"publishedAt":"2026-10-21T16:57:36+00:00","modifiedAt":"2026-10-21T17:15:08.6371723+00:00","affected":[{"ecosystem":"npm","name":"@apostrophecms/import-export","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72","https://nvd.nist.gov/vuln/detail/CVE-2026-112955","https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498","https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1"],"sourceUrl":"https://github.com/advisories/GHSA-9g7p-m758-rp72","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9g7p-m758-rp72","identifiers":["GHSA-9g7p-m758-rp72","CVE-2026-112955"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-02T15:57:21.7951869+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-02T15:57:21.7951869+00:00","lastSuccessAt":"2026-11-02T15:57:21.9738676+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:21.973868+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-37087f5ac35d6d996bd0480d4228062695465d95096b336bdfd509d8efa3a1e5-a8091dc0a29d7844b2e13c2639f30674592bf57246a91084fd278cbb1a230bc8","complete":true,"records":417904,"lastAttemptAt":"2026-11-02T15:57:21.3972529+00:00","lastSuccessAt":"2026-11-02T15:57:21.32916+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:21.3972529+00:00","snapshotPublishedAt":"2026-11-02T15:27:42+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3afbfcfae1fe455bbc5a5006f95b2df4","complete":true,"records":13568,"lastAttemptAt":"2026-11-02T15:57:48.1026017+00:00","lastSuccessAt":"2026-11-02T11:59:30.621+00:00","error":null,"lastVerifiedAt":"2026-11-02T11:59:30.621+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-02T15:57:21.7951869+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-02T15:57:21.7951869+00:00","lastSuccessAt":"2026-11-02T15:57:21.9750587+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:21.9750694+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a52593857bad4381a86db8a8b44be613","complete":true,"records":13580,"lastAttemptAt":"2026-11-02T15:57:47.3816816+00:00","lastSuccessAt":"2026-11-02T15:57:47.378+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:47.378+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-02T15:57:21.7421927+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:21.7421927+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-02T15:57:21.4597553+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:21.4597553+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5eac0f41c5234939771ec81ee6dcecba911c3ba21e363f4cecd95fcede18b96b","complete":true,"records":3035,"lastAttemptAt":"2026-11-02T15:57:21.7576737+00:00","lastSuccessAt":"2026-11-02T13:57:36.6498985+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:21.7576737+00:00","snapshotPublishedAt":"2026-11-02T12:18:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f6b161b825bd02c4d85a20025f15e385f08d9727774eb866871eb8f3ef9e379f","complete":true,"records":231021,"lastAttemptAt":"2026-11-02T15:57:21.6343593+00:00","lastSuccessAt":"2026-11-02T14:59:25.6503802+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:21.6343593+00:00","snapshotPublishedAt":"2026-11-02T14:33:25+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}