The vulnerability resides in the import‑export module of ApostropheCMS prior to version 3.7.1. An authenticated importer can submit archive files whose decompressed data size, number of entries, and individual entry sizes are not limited before the system checks document‑type permissions. This omission allows the attacker to create an archive that consumes large amounts of server storage, potentially leaving incomplete or unused artifacts after parsing failures, and can lead to denial of service.

This flaw affects installations of ApostropheCMS that use the @apostrophecms/import-export module earlier than 3.7.1, regardless of the host's Node.js version. All systems running the open‑source content management system with an older import‑export component are included.

The CVSS score of 6.5 indicates a moderate severity, though the exploit score is currently unknown. The attacker needs an authenticated importer role and can upload a crafted archive to consume disk space before authentication checks succeed; excess consumption will exhaust available storage and degrade or halt service. The vulnerability is not listed in the CISA KEV catalog and no public exploitation has been reported, but the lack of size bounds presents an operational risk that should be mitigated promptly.