Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@apostrophecms/import-export

10 known vulnerabilities (1 critical, 1 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
3.7.1 (Oct 14, 2026): no advisory affects it
Newest unaffected release
3.7.1 (Oct 14, 2026), the latest release
Advisories
10 · 1 critical, 1 high, 7 medium, 1 low
Weekly downloads
1,456
Dependents
0
Releases
36 since 1.0.0 (Oct 12, 2023)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

  • ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

    Affected: fixed in 3.7.0.

    Fixed in 3.7.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 3.7.1, is not affected.

    68% of @apostrophecms/import-export downloads last week were affected versions (1.3K).

  • CVE-2026-113664Medium 5.3

    ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

    Affected: fixed in 3.7.0.

    Fixed in 3.7.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 3.7.1, is not affected.

    68% of @apostrophecms/import-export downloads last week were affected versions (1.3K).

  • CVE-2026-113662Medium 5.4

    ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

    Affected: fixed in 3.7.0.

    Fixed in 3.7.0 (released Sep 30, 2026, 20 days before disclosure).

    The latest release, 3.7.1, is not affected.

    68% of @apostrophecms/import-export downloads last week were affected versions (1.3K).

  • CVE-2026-113649Medium 6.5

    ApostropheCMS: Import API bypasses publication roles for protected content

    Affected: fixed in 3.7.1.

    Fixed in 3.7.1 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 3.7.1, is not affected.

    81% of @apostrophecms/import-export downloads last week were affected versions (1.5K).

  • ApostropheCMS: Missing Authentication in `cleanExport` Route

    Affected: fixed in 3.7.1.

    Fixed in 3.7.1 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 3.7.1, is not affected.

    81% of @apostrophecms/import-export downloads last week were affected versions (1.5K).

  • CVE-2026-112956Medium 6.5

    ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

    Affected: fixed in 3.7.1.

    Fixed in 3.7.1 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 3.7.1, is not affected.

    81% of @apostrophecms/import-export downloads last week were affected versions (1.5K).

  • CVE-2026-112955Medium 6.5

    ApostropheCMS: Import archives can exhaust server storage and deny service

    Affected: fixed in 3.7.1.

    Fixed in 3.7.1 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 3.7.1, is not affected.

    81% of @apostrophecms/import-export downloads last week were affected versions (1.5K).

  • CVE-2026-112953Medium 6.0

    ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

    Affected: fixed in 3.7.1.

    Fixed in 3.7.1 (released Oct 14, 2026, 6 days before disclosure).

    The latest release, 3.7.1, is not affected.

    81% of @apostrophecms/import-export downloads last week were affected versions (1.5K).

  • CVE-2026-63667Medium 6.5

    ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

    Affected: fixed in 3.6.2.

    Fixed in 3.6.2 (released Jul 10, 2026, 38 days before disclosure).

    The latest release, 3.7.1, is not affected.

    62% of @apostrophecms/import-export downloads last week were affected versions (1.2K).

  • CVE-2026-32731Critical 10.0

    ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

    Affected: fixed in 3.5.3.

    Fixed in 3.5.3 (released Mar 18, 2026, the day of disclosure).

    The latest release, 3.7.1, is not affected.

    56% of @apostrophecms/import-export downloads last week were affected versions (1.1K).