CVE-2026-113664 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
ApostropheCMS, a widely utilized open-source content management system built on the Node.js runtime environment, contains a critical flaw within its import-export module that affects versions prior to 3.7.0. The vulnerability arises from an insufficient validation mechanism when processing archive files submitted by authenticated users during data import operations. Specifically, the logic responsible for determining the destination path of extracted tar entries fails to correctly handle cases where the normalized target is a directory rather than a file. While the system implements a guard against parent-path traversal attacks by checking for literal substrings such as .. in the raw input string, this check is bypassed because it does not account for normalization effects that can resolve into valid directory paths without containing those specific characters.
The technical core of this flaw lies in the discrepancy between how the application validates path components and how the underlying file system operations are executed. When an authenticated importer submits a tar archive with entries designed to target directories, the validation logic passes because it does not detect malicious traversal patterns in their literal form. However, when the application attempts to open these targeted directories as write streams for data ingestion or processing, the Node.js runtime encounters an unhandled filesystem error. This occurs because standard file system APIs generally do not permit opening a directory handle with write permissions in the manner expected by the import logic, leading to a fatal exception that crashes the running process.
From an operational impact perspective, this vulnerability primarily manifests as a denial of service condition rather than a direct compromise of data integrity or confidentiality. The crash of the Node.js process disrupts availability for all users interacting with the ApostropheCMS instance at that moment. While the vendor notes that this issue does not constitute an end-to-end exploit for arbitrary file read or write operations, it represents a significant stability risk in production environments where automated import processes are common. An attacker who has obtained valid authentication credentials can trigger repeated crashes by submitting crafted archive files, effectively rendering the content management system unusable until the service is manually restarted.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write in terms of its root cause related to inadequate sanitization of path inputs leading to unexpected runtime behavior. In the context of the MITRE ATT&CK framework, this scenario relates to techniques involving resource exhaustion or service disruption, although it lacks the sophistication for persistent access or lateral movement due to the lack of arbitrary file control. The vulnerability highlights the importance of validating not just the literal string representation of paths but also their normalized forms and ensuring that subsequent operations are compatible with the target entity type, whether file or directory.
To mitigate this risk, organizations running ApostropheCMS must upgrade immediately to version 3.7.0 or later, where the import-export module has been patched to correctly handle directory targets and prevent the associated unhandled exceptions. Until an upgrade is feasible, administrators should restrict access to the import functionality strictly to trusted users with strong authentication controls in place. Additionally, implementing robust process monitoring and auto-restart mechanisms can help minimize downtime if a crash occurs due to malicious input from other sources or residual vulnerabilities. Regular auditing of imported content types and enforcing strict schema validation on incoming archives further reduces the attack surface associated with file system interactions within the CMS.