Import Export
Monthly
Unauthenticated HTTP requests to ApostropheCMS import-export module routes before version 3.7.0 can force the server to initialize uploads, store chunks, and perform temporary processing, consuming disk, memory, and processing resources and degrading availability; ApostropheCMS core prior to 4.33.0 bundles the vulnerable module. The flaw is rated CVSS 7.5 with availability-only impact, requires the import-export module to be installed and its routes network-reachable, and has no public exploit identified at time of analysis.
Authenticated importers in ApostropheCMS can crash the Node.js process by submitting a crafted tar archive to the @apostrophecms/import-export module prior to 3.7.0. The archive entry's normalized destination is aimed at a directory while evading a literal parent-path substring check, causing a write-stream filesystem error that is not handled and terminates the process. This is an authenticated denial-of-service issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no public exploit identified at time of analysis, no KEV listing, and no EPSS score provided; the source establishes a static primitive but not controlled arbitrary file read or write.
The import-export module of ApostropheCMS, in versions prior to 3.7.0, allows an authenticated user who has been granted import access to a document type to supply an object or query operator where a scalar update-key value is expected, so the generated import query matches an existing document the attacker did not deliberately select. Because the normal findForEditing permission filter still applies and the matched document is not attacker-controlled, the overwrite is limited to content the user already has generic edit rights over - there is no bypass into protected or arbitrary content. Both import access and edit permission on the affected type are prerequisites, and only import-export releases below 3.7.0 are affected; no public exploit has been identified at time of analysis.
Editors in ApostropheCMS who can import a content type but lack that type's publish role can use the import-export module's write helpers to create, replace, or remove published document variants, bypassing normal publish-permission and lifecycle checks. The flaw is an authenticated, missing-authorization issue (CWE-862, CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affecting ApostropheCMS core before 4.34.0 when paired with @apostrophecms/import-export before 3.7.1. It is most relevant to deployments that intentionally separate import rights from publication rights; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated tampering with import jobs in ApostropheCMS: the @apostrophecms/import-export module before 3.7.1 exposes POST /api/v1/@apostrophecms/import-export/clean-export without any authentication or authorization check, so any site visitor holding the standard CSRF cookie can invoke cleanExport and discard a pending import's uploaded files and mark that import job completed. Impact is narrow rather than severe - the operation targets a pending import by its random ID, which is only disclosed to the uploading user, so an attacker must already know or observe that identifier, and the site must have the optional import-export module installed with an import in flight. There is no data disclosure and no availability impact; no public exploit identified at time of analysis, and vendor fixes are available in 3.7.1.
Resource exhaustion in ApostropheCMS's import-export module before 3.7.1 allows an authenticated user with importer permission to submit archives whose decompressed bytes, entry count, or per-entry sizes are not bounded before document-type authorization, potentially consuming server resources and leaving staging or extracted artifacts behind after extraction or parsing failures. The flaw is network-reachable and low-complexity but requires a logged-in importer (PR:L), and the maintainers have not validated the full end-to-end denial-of-service impact, so the assessed availability effect is limited. No public exploit or CISA KEV entry is identified in the provided data; the issue is fixed in @apostrophecms/import-export 3.7.1.
Predictable export archive filenames in the @apostrophecms/import-export module before 3.7.1 let an unauthenticated requester derive and fetch another user's export archive from publicly readable export storage while it still exists. Only deployments with the import-export feature enabled and export/upload storage that is publicly reachable over the network are exposed, and the attacker must time the request inside the window before the archive expires or is cleaned up. Exploitation additionally depends on a user with export permission having already created an archive, so real-world risk is conditional rather than universal; no public exploit code or confirmed active exploitation was identified at time of analysis, though the disclosure yields full read access to exported content (CVSS 4.0 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/C:H/I:N/A:N).
Unauthenticated HTTP requests to ApostropheCMS import-export module routes before version 3.7.0 can force the server to initialize uploads, store chunks, and perform temporary processing, consuming disk, memory, and processing resources and degrading availability; ApostropheCMS core prior to 4.33.0 bundles the vulnerable module. The flaw is rated CVSS 7.5 with availability-only impact, requires the import-export module to be installed and its routes network-reachable, and has no public exploit identified at time of analysis.
Authenticated importers in ApostropheCMS can crash the Node.js process by submitting a crafted tar archive to the @apostrophecms/import-export module prior to 3.7.0. The archive entry's normalized destination is aimed at a directory while evading a literal parent-path substring check, causing a write-stream filesystem error that is not handled and terminates the process. This is an authenticated denial-of-service issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no public exploit identified at time of analysis, no KEV listing, and no EPSS score provided; the source establishes a static primitive but not controlled arbitrary file read or write.
The import-export module of ApostropheCMS, in versions prior to 3.7.0, allows an authenticated user who has been granted import access to a document type to supply an object or query operator where a scalar update-key value is expected, so the generated import query matches an existing document the attacker did not deliberately select. Because the normal findForEditing permission filter still applies and the matched document is not attacker-controlled, the overwrite is limited to content the user already has generic edit rights over - there is no bypass into protected or arbitrary content. Both import access and edit permission on the affected type are prerequisites, and only import-export releases below 3.7.0 are affected; no public exploit has been identified at time of analysis.
Editors in ApostropheCMS who can import a content type but lack that type's publish role can use the import-export module's write helpers to create, replace, or remove published document variants, bypassing normal publish-permission and lifecycle checks. The flaw is an authenticated, missing-authorization issue (CWE-862, CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affecting ApostropheCMS core before 4.34.0 when paired with @apostrophecms/import-export before 3.7.1. It is most relevant to deployments that intentionally separate import rights from publication rights; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated tampering with import jobs in ApostropheCMS: the @apostrophecms/import-export module before 3.7.1 exposes POST /api/v1/@apostrophecms/import-export/clean-export without any authentication or authorization check, so any site visitor holding the standard CSRF cookie can invoke cleanExport and discard a pending import's uploaded files and mark that import job completed. Impact is narrow rather than severe - the operation targets a pending import by its random ID, which is only disclosed to the uploading user, so an attacker must already know or observe that identifier, and the site must have the optional import-export module installed with an import in flight. There is no data disclosure and no availability impact; no public exploit identified at time of analysis, and vendor fixes are available in 3.7.1.
Resource exhaustion in ApostropheCMS's import-export module before 3.7.1 allows an authenticated user with importer permission to submit archives whose decompressed bytes, entry count, or per-entry sizes are not bounded before document-type authorization, potentially consuming server resources and leaving staging or extracted artifacts behind after extraction or parsing failures. The flaw is network-reachable and low-complexity but requires a logged-in importer (PR:L), and the maintainers have not validated the full end-to-end denial-of-service impact, so the assessed availability effect is limited. No public exploit or CISA KEV entry is identified in the provided data; the issue is fixed in @apostrophecms/import-export 3.7.1.
Predictable export archive filenames in the @apostrophecms/import-export module before 3.7.1 let an unauthenticated requester derive and fetch another user's export archive from publicly readable export storage while it still exists. Only deployments with the import-export feature enabled and export/upload storage that is publicly reachable over the network are exposed, and the attacker must time the request inside the window before the archive expires or is cleaned up. Exploitation additionally depends on a user with export permission having already created an archive, so real-world risk is conditional rather than universal; no public exploit code or confirmed active exploitation was identified at time of analysis, though the disclosure yields full read access to exported content (CVSS 4.0 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/C:H/I:N/A:N).