ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before document-type authorization, and extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The already-hardened pre-authentication and write-error paths are separate, and current end-to-end denial-of-service impact from this residual path remains subject to maintainer validation. This issue is fixed in version 3.7.1.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub