ApostropheCMS Import-Export CVE-2026-112955

Requires a logged-in user who holds import (importer) permission and reaches the import-export module's archive-upload/import flow; the attacker must submit an archive whose decompressed size, entry count, or per-entry sizes are not bounded before document-type authorization, optionally combined with extraction/parsing failures that leave staging and extracted artifacts uncleaned. Exploitation is LIMITED by: valid authentication plus import authorization (PR:L, not anonymous), applicability only to import-export versions prior to 3.7.1, and the fact that the already-hardened pre-authentication and write-error paths are separate from this residual path. A further real-world limiter is that maintainers have not validated the full end-to-end denial-of-service impact, so practical severity may be lower than the raw vector suggests.

The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 (Medium) and describes a network-reachable, low-complexity, availability-only flaw requiring low privileges (PR:L) - i.e. an authenticated user holding import (importer) rights. No EPSS score, CISA KEV entry, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The most important signal is the vendor's own hedging: the description explicitly states that 'current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation', which directly conflicts with the A:H rating in the input vector - the HIGH availability impact is NOT confirmed end-to-end and should be treated as an unvalidated upper bound. This is a CWE-400 resource-consumption (decompression/zip-bomb-style) issue where decompressed byte totals, entry counts, and entry sizes are not bounded before document-type authorization, compounded by incomplete cleanup of staging/extracted artifacts on parse failure. Net assessment: this is a lower-priority, moderate-severity hardening fix rather than an urgent threat - exploitation requires an already-authenticated privileged importer, the pre-authentication and write-error paths were already hardened separately, and the headline availability impact is unconfirmed by the maintainers themselves.

An authenticated user who already holds import privileges in ApostropheCMS uploads a maliciously crafted archive (e.g. a highly compressed 'decompression bomb' or one with an excessive entry count) through the import-export module. Because decompressed size, entry count, and entry sizes are not bounded before authorization, extraction consumes excessive memory/disk, and failed extractions may leave uncleaned staging artifacts that accumulate over repeated attempts. No public exploit code is known, and the maintainers note the end-to-end denial-of-service impact is still subject to validation.