https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 06:34:24 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113662 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operator as an update-key value, causing the import query to match an unidentified existing document that the user has generic edit permission to modify. The normal findForEditing permission filter still limits the candidate documents, so the issue does not permit permission-free overwrite of arbitrary protected content. This issue is fixed in version 3.7.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113662 https://db.gcve.eu/vuln/ghsa-jqw5-w6h3-44g6 <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>## Summary</p> <p>`@apostrophecms/import-export`&#39;s update-by-key feature lets an imported document carry a `&lt;field&gt;:key` property (for example `slug:key`) whose value is used to find an existing document to update instead of inserting a new one. `getUpdateKey()`/`insertOrUpdateDocWithKey()` (`lib/methods/import.js`) use that value directly as a MongoDB query value with no laundering:</p> <p>```js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: &#39;draft&#39; }), { aposMode: &#39;draft&#39;, [updateField]: doc[updateKey] }).toObject(); ```</p> <p>Archive documents are parsed with EJSON (see `lib/formats/gzip.js`), which revives objects such as `{ $ne: null }` as live values, the same untrusted data source and revival mechanism already fixed once in this module for `findSingletonAposDocId`/`findParkedAposDocId` in GHSA-79qf-vqgc-7xx3. That fix did not touch `insertOrUpdateDocWithKey`, so the identical class of bug survives here: a crafted `&#34;slug:key&#34;: { &#34;$ne&#34;: null }` entry in an archive&#39;s `aposDocs.json` makes the import match (and then update) an existing document the archive&#39;s author never actually identified, instead of failing to find a match.</p> <p>## Impact</p> <p>Reaching this requires only an authenticated session with import access to the target type (the built-in contributor role holds this, matching the precondition of GHSA-79qf-vqgc-7xx3), and no admin interaction. Because the match uses a MongoDB operator instead of an exact value, it is not limited to a document the im…</p> <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>## Summary</p> <p>`@apostrophecms/import-export`&#39;s update-by-key feature lets an imported document carry a `&lt;field&gt;:key` property (for example `slug:key`) whose value is used to find an existing document to update instead of inserting a new one. `getUpdateKey()`/`insertOrUpdateDocWithKey()` (`lib/methods/import.js`) use that value directly as a MongoDB query value with no laundering:</p> <p>```js const matchingDraftPromise = manager.findForEditing( req.clone({ mode: &#39;draft&#39; }), { aposMode: &#39;draft&#39;, [updateField]: doc[updateKey] }).toObject(); ```</p> <p>Archive documents are parsed with EJSON (see `lib/formats/gzip.js`), which revives objects such as `{ $ne: null }` as live values, the same untrusted data source and revival mechanism already fixed once in this module for `findSingletonAposDocId`/`findParkedAposDocId` in GHSA-79qf-vqgc-7xx3. That fix did not touch `insertOrUpdateDocWithKey`, so the identical class of bug survives here: a crafted `&#34;slug:key&#34;: { &#34;$ne&#34;: null }` entry in an archive&#39;s `aposDocs.json` makes the import match (and then update) an existing document the archive&#39;s author never actually identified, instead of failing to find a match.</p> <p>## Impact</p> <p>Reaching this requires only an authenticated session with import access to the target type (the built-in contributor role holds this, matching the precondition of GHSA-79qf-vqgc-7xx3), and no admin interaction. Because the match uses a MongoDB operator instead of an exact value, it is not limited to a document the im…</p> https://db.gcve.eu/vuln/ghsa-jqw5-w6h3-44g6