IM
Product
import-export
8
CVEs
0
On KEV
9.9
Max CVSS
7
New 30D
Severity mix
Critical 1High 1Medium 5Low 1
Watch
Add import-export to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-32731 | 9.9 | Mar 18 | ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction Affected: < 3.5.3 |
| CVE-2026-113711 | 7.5 | Oct 20 | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export Affected: < 3.7.0 |
| CVE-2026-113649 | 6.5 | Oct 20 | ApostropheCMS: Import API bypasses publication roles for protected content Affected: < 3.7.1 |
| CVE-2026-112955 | 6.5 | Oct 20 | ApostropheCMS: Import archives can exhaust server storage and deny service Affected: < 3.7.1 |
| CVE-2026-112953 | 6.0 | Oct 20 | ApostropheCMS: Exposure of Sensitive Information via predictable export filenames Affected: < 3.7.1 |
| CVE-2026-113662 | 5.4 | Oct 20 | ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document Affected: < 3.7.0 |
| CVE-2026-113664 | 5.3 | Oct 20 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test Affected: < 3.7.0 |
| CVE-2026-113648 | 3.1 | Oct 20 | ApostropheCMS: Missing Authentication in `cleanExport` Route Affected: < 3.7.1 |
Showing 8