Quick answers
- Is CVE-2026-112955 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-112955 being exploited in the wild.
- How severe is CVE-2026-112955?
- Medium severity, with a CVSS score of 6.5, published 20 October 2026.
- Which products and versions are affected?
- ApostropheCMS Apostrophe prior to 3.7.1; @apostrophecms/import-export (npm) < 3.7.1, SEMVER:introduced=0,fixed=3.7.1.
- Is there a fix for CVE-2026-112955?
- Yes. @apostrophecms/import-export (npm): upgrade to 3.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-112955 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-112955?
- Check whether you run ApostropheCMS Apostrophe or @apostrophecms/import-export (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @apostrophecms/import-export (npm): upgrade to 3.7.1 or later
npm install @apostrophecms/import-export@3.7.1
Technical details
The vulnerability exists in the import-export module prior to version 3.7.1, where archive decompression, entry count, and entry sizes lack bounds validation before document-type authorization is checked. Extraction or parsing failures can leave staging and extracted artifacts without unconditional cleanup. The attack requires authentication with import permissions and network access to the import endpoint, allowing denial of service via resource exhaustion.
Affected products
- ApostropheCMS Apostrophe prior to 3.7.1
Identifiers
- CVE-2026-112955
- GHSA-9g7p-m758-rp72
Timeline
- 2026-10-20: disclosed
- 2026-10-14: patched