Security
فارسی
All products

@apostrophecms/import-export

npm · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
ApostropheCMS: Arbitrary file read via import-export attachment-name path traversalCVE-2026-63667 · GHSA-79QF-VQGC-7XX3 @apostrophecms/import-export npm Medium Fix reported
ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesCVE-2026-112953 · GHSA-5GC8-FRW3-3VQM @apostrophecms/import-export npm Medium Fix reported
ApostropheCMS: Missing Authentication in `cleanExport` RouteCVE-2026-113648 · GHSA-RW26-WWFC-9WVM @apostrophecms/import-export npm Low Fix reported
ApostropheCMS: Import API bypasses publication roles for protected contentCVE-2026-113649 · GHSA-5M22-7PFQ-VP65 @apostrophecms/import-exportapostrophe npm Medium Fix reported
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentCVE-2026-112956 · GHSA-JF5H-36MG-RP6X @apostrophecms/import-export npm Medium Fix reported
ApostropheCMS: Import archives can exhaust server storage and deny serviceCVE-2026-112955 · GHSA-9G7P-M758-RP72 @apostrophecms/import-export npm Medium Fix reported
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportCVE-2026-113711 · GHSA-86WM-68PQ-5JWQ @apostrophecms/import-exportapostrophe npm High Fix reported
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testCVE-2026-113664 · GHSA-97WV-P4XX-C7MG @apostrophecms/import-export npm Medium Fix reported
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentCVE-2026-113662 · GHSA-JQW5-W6H3-44G6 @apostrophecms/import-export npm Medium Fix reported
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip ExtractionCVE-2026-32731 · GHSA-MWXC-M426-3F78 @apostrophecms/import-export npm Critical Fix reported