Login Request a demo
IM
Product
import-export
by apostrophecms · last CVE Oct 20, 2026
8
CVEs
0
On KEV
9.9
Max CVSS
7
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 1High 1Medium 5Low 1
Severity
All severities8Critical1High1Medium5Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add import-export to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-113649
6.5
0%
Oct 20
ApostropheCMS: Import API bypasses publication roles for protected content
Affected: < 3.7.1
CVE-2026-112955
6.5
1%
Oct 20
ApostropheCMS: Import archives can exhaust server storage and deny service
Affected: < 3.7.1
CVE-2026-112953
6.0
1%
Oct 20
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
Affected: < 3.7.1
CVE-2026-113662
5.4
0%
Oct 20
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
Affected: < 3.7.0
CVE-2026-113664
5.3
0%
Oct 20
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
Affected: < 3.7.0
Showing 5