Description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T20:16:44.720Z",
  "pubdate": "2026-08-17T20:16:44.720Z",
  "executiveSummary": "A path traversal and arbitrary file read vulnerability exists in the import-export module of ApostropheCMS prior to version 3.6.2. The flaw arises due to improper sanitization of attacker-controlled fields within the aposAttachments.json file during the archive import process, specifically in packages/import-export/lib/formats/gzip.js. An authenticated contributor can exploit this vulnerability by supplying a maliciously crafted archive containing manipulated _id, name, and extension fields. Successful exploitation allows the adversary to traverse the file system, read arbitrary host files that possess an allowed extension, and subsequently publish the copied file at an unauthenticated uploads URL. This poses a significant risk to confidentiality and integrity by exposing sensitive system or application files to internal actors with contributor privileges. Mitigation requires upgrading ApostropheCMS to version 3.6.2 or later, where path validation ensures that resolved attachment source paths strictly remain confined within the designated extracted attachments directory.",
  "technicalDetails": "The vulnerability resides in the import-export module of ApostropheCMS, specifically within the packages/import-export/lib/formats/gzip.js file. The root cause of the issue is insufficient path validation and sanitization when constructing file system paths for attachments during archive extraction. Specifically, the application constructs an attachment source path dynamically by concatenating the attacker-controlled _id, name, and extension fields extracted from the aposAttachments.json metadata file included in an import archive.\nBecause the application fails to enforce boundary checks or canonicalize the resulting path to ensure it remains strictly contained within the intended extracted attachments directory, path traversal sequences or absolute references can be injected. The attack flow proceeds as follows: First, an authenticated attacker with contributor privileges crafts a malicious gzip archive containing a modified aposAttachments.json file with specially manipulated _id, name, and extension parameters designed to target a specific file on the host operating system. Second, the attacker uploads and initiates the import process of this crafted archive via the application interface. Third, the vulnerable gzip.js processing logic reads the malicious metadata and constructs a file path that escapes the intended extraction boundary, pointing to a targeted host file with an allowed extension. Fourth, the system processes the file copy operation, reading the targeted host file from the underlying filesystem. Finally, the application publishes the copied file, making its contents accessible to unauthorized entities via an unauthenticated uploads URL.\nThe affected component is the attachment import mechanism in packages/import-export/lib/formats/gzip.js for ApostropheCMS versions prior to 3.6.2. Exploitation requires authenticated access with contributor-level privileges to initiate an import action. The vulnerability manifests locally through the file system operations performed by the Node.js application, resulting in unauthorized file disclosure accessible via network-exposed upload URLs."
}