Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
apostrophecms apostrophe
< 4.34.0affected
@apostrophecms import-export
< 3.7.1affected
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-9g7p-m758-rp72 ↗
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 ↗
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea ↗
- https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1 ↗