CVE-2026-63667: ApostropheCMS Path Traversal Vulnerability

CVE-2026-63667 Overview

ApostropheCMS is an open-source Node.js content management system. Versions prior to 3.6.2 contain a path traversal vulnerability [CWE-22] in the import-export module. The packages/import-export/lib/formats/gzip.js component constructs attachment source paths from attacker-controlled _id, name, and extension fields in aposAttachments.json without validating that the resolved path stays within the extracted attachments directory.

An authenticated contributor can import a crafted archive to read a host file with an allowed extension and publish the copied file at an unauthenticated uploads URL. The issue is fixed in version 3.6.2.

Critical Impact
Authenticated contributors can read arbitrary host files with allowed extensions and expose them at public, unauthenticated URLs.

Affected Products

ApostropheCMS versions prior to 3.6.2
@apostrophecms/import-export module (bundled in affected releases)
Node.js sites relying on the ApostropheCMS import-export archive feature

Discovery Timeline

2026-08-17 - CVE-2026-63667 published to NVD
2026-08-17 - Last updated in NVD database

Technical Details for CVE-2026-63667

Vulnerability Analysis

The flaw resides in the gzip import format handler at packages/import-export/lib/formats/gzip.js. When processing an uploaded archive, the module reads aposAttachments.json and builds a source path for each attachment by concatenating the extraction directory with attacker-supplied _id, name, and extension values.

The handler never canonicalizes the resulting path or verifies that it remains under the intended attachments directory. Because ApostropheCMS then copies the resolved file into the site's public uploads location, the attacker turns an archive parse into an arbitrary file read followed by an unauthenticated file publication.

Root Cause

The root cause is missing path containment validation on user-controlled archive metadata. Values such as _id: "../../../etc/passwd_id" or crafted name and extension fields cause path.join or string concatenation to escape the extraction sandbox. This is a classic [CWE-22] Improper Limitation of a Pathname to a Restricted Directory issue.

Attack Vector

Exploitation requires authenticated access at the contributor role, which is the lowest privilege permitted to run imports. The attacker crafts a .tar.gz archive containing an aposAttachments.json whose attachment entries reference host paths outside the extraction directory but retain an allow-listed extension. After import, the referenced file is copied under /uploads/, where it is served without authentication.

javascript

// Patch excerpt: packages/import-export/lib/formats/gzip.js
 const zlib = require('node:zlib');
 const tar = require('tar-stream');
 const { EJSON } = require('bson');
-const { Writable } = require('stream');

 module.exports = {
   label: 'gzip',
// Source: https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a

A companion hardening change in packages/import-export/lib/methods/import.js coerces EJSON-revived query fields to plain strings to block MongoDB operator injection via the same untrusted archive:

javascript

// Patch excerpt: packages/import-export/lib/methods/import.js
 async findSingletonAposDocId({ type, aposLocale }) {
+  // `type` and `aposLocale` originate from the untrusted archive and are
+  // parsed with EJSON, which can revive query operators such as
+  // `{ $ne: null }`. Coerce them to plain strings so they cannot act as
+  // MongoDB operators in this selector (a no-op for valid values).
   const singleton = await self.apos.doc.db.findOne({
     $and: [
-      { type },
+      { type: self.apos.launder.string(type) },
       {
         $or: [
           { aposLocale: { $exists: false } },
-          { aposLocale }
+          { aposLocale: self.apos.launder.string(aposLocale) }
         ]
       }
     ]
// Source: https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a

Detection Methods for CVE-2026-63667

Indicators of Compromise

Unexpected files appearing in the site's public/uploads/attachments/ directory that do not correspond to legitimate media uploads.
Import-export archive uploads from contributor-role accounts containing aposAttachments.json entries with ../ sequences or absolute paths in _id, name, or extension fields.
Access log entries fetching newly published /uploads/attachments/ URLs shortly after an import job completes.

Detection Strategies

Inspect ApostropheCMS import job logs for archives processed by contributor accounts and correlate them with new files written under the uploads path.
Statically scan uploaded .tar.gz archives before processing to reject entries whose aposAttachments.json fields contain path separators or traversal sequences.
Compare copied attachment destinations against the archive's declared extraction root and alert on any mismatch.

Monitoring Recommendations

Enable audit logging on the import-export module and forward events to a centralized log store for correlation.
Monitor the operating system for reads of sensitive files (for example, /etc/passwd, application config files) by the Node.js process during import operations.
Alert on contributor-role activity that triggers write operations under the public uploads directory.

How to Mitigate CVE-2026-63667

Immediate Actions Required

Upgrade ApostropheCMS to version 3.6.2 or later, which contains the fix in the @apostrophecms/import-export module.
Restrict import-export permissions to trusted administrator accounts until the upgrade is applied.
Review the public/uploads/attachments/ directory for unexpected files and remove any that cannot be traced to legitimate content.

Patch Information

The fix is available in ApostropheCMS 3.6.2. See the GitHub Security Advisory GHSA-79qf-vqgc-7xx3 and the remediation commit 87cccf4 for full technical details.

Workarounds

Disable the import-export module or remove import permissions from the contributor role on affected versions.
Place a web application firewall rule in front of import endpoints to reject archives whose metadata contains path traversal sequences.
Serve the /uploads/ path through a proxy that enforces an allow list of expected file names until patching is complete.

bash

# Configuration example: upgrade ApostropheCMS to the patched release
npm install apostrophe@3.6.2
npm ls apostrophe
# Verify installed version is >= 3.6.2 before re-enabling contributor imports