ApostropheCMS import-export EUVD-2026-105223

Requires that the ApostropheCMS import-export module (the @apostrophecms/import-export package, versions prior to 3.7.0) be installed and that its import routes be network-reachable by the attacker; core ApostropheCMS without this module is not affected. No authentication, user interaction, or special privileges are needed (PR:N/UI:N) because the resource-consuming middleware runs before the user/authorization check. The practical limiting factors are therefore (1) presence of the vulnerable import-export module, and (2) exposure of the import endpoints to untrusted networks; impact is limited to availability - no data is read or modified.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a remote, unauthenticated attacker can reach the import routes and cause bigUploadMiddleware to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup BEFORE the user/authorization check rejects the request - a classic pre-auth resource-exhaustion pattern (CWE-400). The impact is confined to availability (C:N/I:N) - there is no code execution, data disclosure, or integrity loss, so despite the HIGH 7.5 score this is a DoS-only issue, not a system-compromise bug. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' A key limiting factor NOT reflected in the raw CVSS is that the separately-versioned import-export module (fixed in 3.7.0) must be installed and its import routes exposed - core-only ApostropheCMS installs are not affected. Note also that SSVC/automatable data was not supplied. Net: a real patch-worthy priority for sites running the import-export module exposed to untrusted networks, but it should rank below any confidentiality/integrity or actively-exploited issue.

An attacker who can reach a public ApostropheCMS site that has the import-export module installed sends repeated unauthenticated requests to the import routes. Because bigUploadMiddleware runs its upload-initialization, chunk-storage and temporary-processing work before the authorization check rejects the request, each request consumes CPU, memory, disk and I/O, and a flood of them exhausts server resources and degrades or denies service. No public proof-of-concept exploit was referenced in the available data.