CVE-2026-112955: CWE-400: Uncontrolled Resource Consumption in apostrophecms apostrophe

ApostropheCMS, an open-source Node.js CMS, had a vulnerability (CVE-2026-112955) in its import-export module before version 3.7.1. Authenticated users could submit archive files whose decompressed data size, number of entries, and entry sizes were not limited prior to authorization checks. Additionally, extraction or parsing failures could leave temporary files without unconditional cleanup. Although pre-authentication and write-error paths are hardened and separate, residual denial-of-service impact from this vulnerability remains under maintainer validation. The vulnerability is addressed in version 3.7.1.

The vulnerability can lead to uncontrolled resource consumption on the server due to unbounded archive decompression and incomplete cleanup of temporary files, resulting in denial-of-service (DoS) conditions. There is no impact on confidentiality or integrity reported. Exploitation requires authenticated access. No known exploits in the wild have been reported.

Upgrade the ApostropheCMS import-export module to version 3.7.1 or later, where this vulnerability is fixed. No additional mitigation is required as the fix addresses the uncontrolled resource consumption and cleanup issues.