Start for Free
npm

@apostrophecms/import-export

View on npm registry
10 Total advisories
10 Vulnerabilities
0 Malware

Dependency scanning

Check whether @apostrophecms/import-export is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

MEDIUM 6.5
npm

CVE-2026-63667

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
UNKNOWN
npm

CVE-2026-112953

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
LOW 3.1
npm

CVE-2026-113648

ApostropheCMS: Missing Authentication in `cleanExport` Route
MEDIUM 6.5
npm

CVE-2026-113649

ApostropheCMS: Import API bypasses publication roles for protected content
MEDIUM 6.5
npm

CVE-2026-112955

ApostropheCMS: Import archives can exhaust server storage and deny service
MEDIUM 6.5
npm

CVE-2026-112956

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
HIGH 7.5
npm

CVE-2026-113711

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
UNKNOWN
npm

CVE-2026-113664

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
MEDIUM 5.4
npm

CVE-2026-113662

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
CRITICAL 9.9
npm

CVE-2026-32731

ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

Browse more npm advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes