CVE-2026-113662 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS installations using the @apostrophecms/import-export module should assess exposure and prioritize verification and updates. This includes reviewing import-export configurations for potential exposure and monitoring for suspicious activity. Operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential risks and take necessary precautions to mitigate them.

Why it matters

Defenders should care about CVE-2026-113662 because it allows crafted imports to potentially update unauthorized documents in ApostropheCMS, risking data integrity. Verification and updates to @apostrophecms/import-export are crucial.

• Potential unauthorized document updates
• Data integrity risks due to crafted imports
• Need for verification of import-export configurations

Technical summary

The @apostrophecms/import-export module is vulnerable to NoSQL injection via the update-key value, allowing a crafted import to match and overwrite an unidentified document. This vulnerability arises from the module's use of user-supplied input directly in a MongoDB query without proper validation or sanitization. The issue enables attackers to manipulate the import process to update documents without proper authorization, potentially compromising data integrity. Technical details include the affected code in lib/methods/import.js and the role of EJSON in reviving objects such as { $ne: null }.

Defensive priority

Defenders should prioritize verifying and updating @apostrophecms/import-export to version 3.7.0 or later, and review import-export configurations for potential exposure.

Recommended defensive actions

• Verify and update @apostrophecms/import-export to version 3.7.0 or later
• Review import-export configurations for potential exposure
• Monitor for suspicious import-export activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides details on the vulnerability in @apostrophecms/import-export, including code snippets and references to affected versions. The vulnerability is caused by the use of user-supplied input directly in a MongoDB query without proper laundering. This allows attackers to craft imports that can match and overwrite unidentified documents. Evidence of this vulnerability includes the provided code snippets and references to affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.