CVE-2026-112955 apostrophecms CVE debrief

Who should care

Defenders responsible for systems using @apostrophecms/import-export version 3.7.0 should verify exposure and apply the remediation to prevent denial-of-service attacks. This includes reviewing system logs for signs of exploitation attempts and implementing additional monitoring to detect potential denial-of-service attacks. Defenders should prioritize verifying exposure and applying the remediation for systems using @apostrophecms/import-export version 3.

Why it matters

Defenders should prioritize verifying exposure and applying the remediation for systems using @apostrophecms/import-export version 3.7.0, as the vulnerability can lead to denial of service. The lack of resource quotas and failure cleanup during import archive extraction can be exploited to exhaust server storage and deny service. The issue has been addressed in version 3.7.1.

• Denial of service due to server storage exhaustion.
• Potential for attackers to exhaust server resources, leading to service unavailability.

Technical summary

The @apostrophecms/import-export package, version 3.7.0, lacks resource quotas and failure cleanup during import archive extraction, which can lead to denial of service. The issue has been addressed in version 3.7.1. This vulnerability allows attackers to exhaust server storage and deny service. Defenders should prioritize verifying exposure and applying the remediation for systems using @apostrophecms/import-export version 3.7.0, as the vulnerability can lead to denial of service. The lack of resource quotas and failure cleanup during import archive extraction can be exploited to exhaust server storage and deny service.

Defensive priority

Defenders should prioritize verifying exposure and applying the remediation for systems using @apostrophecms/import-export version 3.7.0, as the vulnerability can lead to denial of service.

Recommended defensive actions

• Verify the version of @apostrophecms/import-export in use and upgrade to version 3.7.1 or later if necessary.
• Review system logs for signs of exploitation attempts.
• Implement additional monitoring to detect potential denial-of-service attacks.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The source corpus provides details on the vulnerability in @apostrophecms/import-export version 3.7.0, including the lack of resource quotas and failure cleanup during import archive extraction. The original reproduction material is available in a private attachment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.