CVE-2026-63667 in Apostrophe
Summary
by MITRE • 08/17/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
ApostropheCMS represents a widely utilized open-source content management system built on Node.js, designed to facilitate flexible website creation and maintenance. Within this ecosystem, the import-export module serves as a critical utility for migrating or backing up site data by handling various file formats including gzip archives. A significant security flaw was identified in versions prior to 3.6.2 within the specific handler located at packages/import-export/lib/formats/gzip.js. This component is responsible for processing uploaded archive files and extracting their contents into designated directories on the server hosting the CMS application. The vulnerability stems from an insufficient validation mechanism when constructing file paths during the extraction process, specifically regarding how attachment metadata fields are processed to determine destination locations.
The technical core of this flaw lies in a path traversal weakness where the system fails to properly canonicalize or validate the resolved file path against the intended target directory. When processing a crafted gzip archive submitted by an authenticated user with contributor-level privileges, the application constructs the source path for attachments using data derived from attacker-controlled fields such as _id, name, and extension found in aposAttachments.json metadata files embedded within the archive. Because the system does not enforce strict boundary checks to ensure that the final resolved path remains strictly under the extracted attachments directory, an adversary can manipulate these input parameters to reference arbitrary locations on the host file system. This lack of sanitization allows for classic directory traversal attacks where relative paths containing sequences like dot-dot-slash are interpreted literally rather than being rejected or normalized safely by the operating system's security model.
The operational impact of this vulnerability is severe due to its potential for unauthorized data access and subsequent persistence on the web server. An authenticated contributor can exploit this flaw to read sensitive host files that possess allowed extensions, effectively bypassing standard file type restrictions intended to limit exposure. Once a target file is successfully extracted from an arbitrary location such as /etc/passwd or configuration files containing database credentials, the attacker gains the ability to publish this copied content at an unauthenticated uploads URL. This transformation of internal server data into publicly accessible web resources means that sensitive information can be exfiltrated without requiring further authentication steps after the initial import action. The combination of authenticated access and subsequent public exposure creates a high-risk scenario for data leakage across enterprise deployments relying on ApostropheCMS.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The exploitation technique involves manipulating input variables to access resources outside the intended scope, violating the principle of least privilege and secure file handling practices. From an offensive security perspective, this behavior maps closely to ATT&CK techniques involving File and Directory Discovery followed by Exfiltration Over Web Service, highlighting how internal reconnaissance can lead directly to data theft through web-facing endpoints. The attack vector requires initial authentication but leverages a trusted administrative function for malicious purposes, underscoring the risk of privilege escalation via feature abuse rather than traditional permission bypasses.
Mitigation strategies primarily involve upgrading to version 3.6.2 or later where this issue has been resolved by implementing robust path validation logic that ensures all extracted files remain within the designated attachments directory regardless of input content. Organizations should also enforce strict file extension whitelisting and validate metadata fields before processing them into filesystem operations. Additionally, running the CMS application with minimal required permissions can limit the scope of damage if a traversal attempt succeeds, while monitoring import logs for anomalous path structures provides an additional layer of defense against exploitation attempts in production environments.