CVE-2026-112955 Details

A denial-of-service vulnerability has been identified in the ApostropheCMS import-export module, affecting versions prior to 3.7.1. The issue arises because the importer can upload archives without proper limits on decompressed size, entry count, or entry types, before document-type authorization. This can lead to excessive storage use and leftover artifacts from failed extractions or parsing, creating a potential denial-of-service condition. Although some improvements have been made, such as requiring authentication for large uploads and handling write errors, the core issues remain unaddressed.

Users can update to version 3.7.1 of the ApostropheCMS import-export module, which addresses this vulnerability.