https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 16:59:27 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112956 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112956 https://db.gcve.eu/vuln/ghsa-jf5h-36mg-rp6x <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>## Review scope and evidence limits</p> <p>Package: @apostrophecms/import-export, version 3.7.0.</p> <p>Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).</p> <p>Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.</p> <p>The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.</p> <p>## Archive duplicate continuation permits unauthorized published-content replacement</p> <p>The overrideDuplicates() continuation still accepts client-supplied replacement choices, rather than binding them to a server-maintained, user-owned duplicate analysis. The replacement and write helpers do not establish a single canonical resource identity and authorization context before the update. This leaves the reported gap between draft editing authority and the published target selected for replacement unresolved at source level.</p> <p>The original report describes a contributor crossing the publicati…</p> <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>## Review scope and evidence limits</p> <p>Package: @apostrophecms/import-export, version 3.7.0.</p> <p>Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).</p> <p>Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.</p> <p>The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.</p> <p>## Archive duplicate continuation permits unauthorized published-content replacement</p> <p>The overrideDuplicates() continuation still accepts client-supplied replacement choices, rather than binding them to a server-maintained, user-owned duplicate analysis. The replacement and write helpers do not establish a single canonical resource identity and authorization context before the update. This leaves the reported gap between draft editing authority and the published target selected for replacement unresolved at source level.</p> <p>The original report describes a contributor crossing the publicati…</p> https://db.gcve.eu/vuln/ghsa-jf5h-36mg-rp6x