{"id":"ghsa-ghsa-9g7p-m758-rp72","seq":32737,"kind":"advisory","title":"ApostropheCMS: Import archives can exhaust server storage and deny service","url":"https://github.com/advisories/GHSA-9g7p-m758-rp72","permalink":"https://vulnpulse.app/items/ghsa-ghsa-9g7p-m758-rp72","summary":"影響: npm:@apostrophecms/import-export < 3.7.1 → 3.7.1\nReview scope and evidence limits Package: @apostrophecms/import-export, version 3.7.0. Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026). Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6. The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not rep…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112955"],"tags":["GHSA-9g7p-m758-rp72","@apostrophecms/import-export"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:57:36.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}