CVE-2026-63667
Received Received - Intake

Path Traversal in ApostropheCMS Import-Export Module

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-63667
EUVD
EUVD-2026-60441

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe to 3.6.2 (exc)
apostrophecms import-export From 3.6.2 (exc)
apostrophecms apostrophe 3.6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in ApostropheCMS versions before 3.6.2. It allows authenticated contributors to import a crafted archive that reads host files with allowed extensions (like txt, csv, pdf) and publishes them at an unauthenticated uploads URL. The flaw occurs in the import-export module where attachment paths are constructed from attacker-controlled fields without proper checks.

Detection Guidance

Check ApostropheCMS version with npm list @apostrophecms/import-export. If version is <=3.6.1, the system is vulnerable. Inspect imported archives for aposAttachments.json files with suspicious name or extension fields. Monitor for unauthorized file reads in system logs targeting ApostropheCMS directories.

Impact Analysis

An attacker with contributor access could read sensitive files on the server, such as configuration files, user documents, or database dumps. They could then expose this data publicly via the unauthenticated uploads URL. The impact includes data leaks and potential unauthorized access to internal resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal or health data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to data breaches.

Mitigation Strategies

Upgrade ApostropheCMS to version 3.6.2 or later immediately. Restrict contributor-level access to trusted users only. Review recent imports for suspicious archives. Implement file integrity monitoring for ApostropheCMS directories. Block public access to internal file paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart