CVE-2026-113711 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS deployments using the @apostrophecms/import-export package should assess their exposure and prioritize verification and remediation efforts.

Why it matters

Defenders should care about CVE-2026-113711 because it allows unauthenticated remote attackers to cause resource exhaustion and potentially impact data integrity in ApostropheCMS deployments using the @apostrophecms/import-export package. The vulnerability requires verification of the affected version range and remediation priority to prevent potential denial-of-service and data integrity impacts.

• Potential denial-of-service due to resource exhaustion
• Possible data integrity impacts due to unauthorized upload and processing
• Required verification of affected version range and remediation priority
• Potential for attacker-controlled cleanup operations

Technical summary

The @apostrophecms/import-export package is vulnerable to an unauthenticated resource exhaustion attack due to a missing authorize callback in the bigUploadMiddleware function. This allows an unauthenticated remote attacker to create server-side upload state, write chunk data to upload storage, trigger temporary-file processing, and cause attacker-controlled cleanup operations before authentication is enforced.

Defensive priority

Defenders should prioritize verifying the affected version range of @apostrophecms/import-export and upgrading to version 3.7.0 or later, or applying compensating controls to restrict access to the import API routes.

Recommended defensive actions

• Verify the affected version range of @apostrophecms/import-export and upgrade to version 3.7.0 or later
• Apply compensating controls to restrict access to the import API routes
• Monitor for suspicious activity on the import API routes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The source corpus provides limited information about the vulnerability, but it appears that an unauthenticated remote attacker can create server-side upload state, write chunk data to upload storage, trigger temporary-file processing, and cause attacker-controlled cleanup operations before authentication is enforced.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.