CVE-2026-113648

Deferred Deferred - Pending Action

Path Traversal in ApostropheCMS Import-Export Module

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113648

EUVD

EUVD-2026-105172

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.34.0
@apostrophecms	import-export	< 3.7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects ApostropheCMS's import-export module versions before 3.7.1. The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks authentication checks, allowing unauthenticated users with a CSRF cookie to trigger cleanup operations via the self.cleanExport(req) method.

Detection Guidance

Check if your ApostropheCMS instance is running a vulnerable version of the import-export module (prior to 3.7.1). Inspect network logs for POST requests to /api/v1/@apostrophecms/import-export/clean-export from unauthenticated sources. Verify if the CSRF cookie is being used to bypass authentication.

Impact Analysis

An attacker could exploit this to delete temporary export files, modify job records in the database, or dismiss notifications without proper authorization. This requires a valid CSRF cookie but no further authentication.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it involves unauthorized cleanup operations rather than data breaches or unauthorized access to sensitive data. The issue allows unauthenticated users to trigger cleanup tasks, which may affect data integrity but does not expose or leak personal or health information.

Mitigation Strategies

Upgrade the @apostrophecms/import-export module to version 3.7.1 or later. Add authentication checks to the cleanExport and overrideDuplicates endpoints in apiRoutes.js to ensure only authenticated users can access them.

Hi! I’m here to help you understand CVE-2026-113648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...