CVE-2026-112955 in Apostrophe
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS represents a significant open-source content management system built on the Node.js platform, widely utilized for its flexibility and modular architecture. Within this ecosystem, the import-export module serves as a critical component allowing administrators to migrate data or restore backups by processing archive files containing various document types. The security integrity of this process relies heavily on strict validation controls applied before any file is written to disk or processed further within the application logic. In versions prior to 3.7.1, a specific architectural flaw existed in how these archives were handled during the ingestion phase, creating a window for potential abuse by authenticated users who possess import privileges.
The core technical vulnerability lies in the lack of bounds checking on critical metrics associated with archive extraction before document-type authorization occurs. Specifically, when an authenticated user submits an archive file, the system fails to enforce limits on decompressed bytes, the total count of entries within the archive, and the individual sizes of those entries prior to validating whether the requested document type is authorized for import. This oversight means that a malicious actor can craft an archive designed to consume excessive resources or trigger parsing failures without being blocked by initial authorization checks. The absence of these bounds allows the system to proceed with resource-intensive operations even when the input data exceeds safe thresholds, effectively bypassing intended safeguards against oversized payloads.
Furthermore, the vulnerability is compounded by inadequate cleanup procedures in error scenarios. When extraction or parsing fails due to malformed or excessively large archives, the staging directories and extracted artifacts are not unconditionally cleaned up. This residual state management issue means that temporary files remain on the filesystem even after a failed operation completes. While this does not directly lead to remote code execution, it creates conditions conducive to denial-of-service attacks by exhausting disk space over time through repeated submissions of malicious archives. The existing pre-authentication and write-error paths have been hardened separately, indicating that developers were aware of some attack vectors but missed the specific residual path associated with post-authorization failures in the import workflow.
From an operational perspective, this vulnerability primarily impacts availability rather than confidentiality or integrity at the code execution level. An authenticated attacker could leverage this flaw to degrade system performance or render the CMS unavailable by filling up storage resources through repeated failed extractions of oversized archives. The impact is classified as a denial-of-service condition resulting from resource exhaustion. Although the current end-to-end impact remains subject to maintainer validation, the potential for sustained disruption poses a significant risk to production environments where uptime and stability are paramount. This aligns with CWE-409, which describes improper handling of exceptionally large files or data structures that can lead to system instability or crashes.
In terms of threat modeling, this vulnerability maps to ATT&CK techniques related to resource hijacking and denial-of-service via application layer attacks. The lack of input validation on archive metrics corresponds to CWE-20 Improper Input Validation, while the failure to clean up temporary files relates to CWE-377 Insecure Temporary File Creation or handling issues that persist beyond their intended lifecycle. These weaknesses allow an attacker to manipulate system resources in ways not anticipated by the original design, exploiting gaps between authorization checks and resource allocation limits.
To mitigate this risk, organizations running ApostropheCMS must upgrade immediately to version 3.7.1 or later, where these bounds checking mechanisms have been implemented. Until upgrading is possible, administrators should restrict import privileges to only those users who absolutely require them, thereby reducing the attack surface available to potential insiders or compromised accounts. Additionally, implementing external monitoring for disk usage spikes and unusual patterns in archive upload activity can help detect attempted exploitation of this flaw before it leads to service disruption. Regular audits of file system cleanup processes across all modules are also recommended to ensure no other similar residual state issues exist within the application logic.