Vulnerabilities in @apostrophecms
13 resultsCVE-2026-113711HIGHApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportEPSS 0.6%CVE-2026-112953MEDIUMApostropheCMS: Exposure of Sensitive Information via predictable export filenamesEPSS 0.6%CVE-2026-112955MEDIUMApostropheCMS: Import archives can exhaust server storage and deny serviceEPSS 0.5%CVE-2026-113664MEDIUMApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testEPSS 0.5%CVE-2026-113656MEDIUMApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSEPSS 0.5%CVE-2026-113666HIGHApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceEPSS 0.4%CVE-2026-113669MEDIUMApostropheCMS: Cross-domain session token in URL confers session takeoverEPSS 0.4%CVE-2026-113667MEDIUMApostropheCMS: CAPTCHA response token not URL-encodedEPSS 0.4%CVE-2026-112956MEDIUMApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentEPSS 0.3%CVE-2026-113671MEDIUMApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFEPSS 0.3%CVE-2026-113648LOWApostropheCMS: Missing Authentication in `cleanExport` RouteEPSS 0.3%CVE-2026-113662MEDIUMApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentEPSS 0.3%CVE-2026-113649MEDIUMApostropheCMS: Import API bypasses publication roles for protected contentEPSS 0.3%