Vulnerability-Lookup

CVE-2026-63667 (GCVE-0-2026-63667)

Vulnerability from cvelistv5 – Published: 2026-08-17 19:56 – Updated: 2026-08-17 20:05

Title

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

Summary

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 20:05 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/apostrophecms/apostrophe/secur…	x_refsource_CONFIRM
https://github.com/apostrophecms/apostrophe/commi…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
apostrophecms	apostrophe	Affected: < 3.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63667",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T20:05:34.998193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T20:05:42.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T19:56:07.436Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a"
        }
      ],
      "source": {
        "advisory": "GHSA-79qf-vqgc-7xx3",
        "discovery": "UNKNOWN"
      },
      "title": "ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63667",
    "datePublished": "2026-08-17T19:56:07.436Z",
    "dateReserved": "2026-07-17T14:47:08.032Z",
    "dateUpdated": "2026-08-17T20:05:42.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63667",
      "date": "2026-10-03",
      "epss": "0.0046",
      "percentile": "0.3765"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "apostrophe",
                "vendor": "apostrophecms",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 3.6.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2."
          }
        ],
        "id": "CVE-2026-63667",
        "lastModified": "2026-09-09T21:11:46.833",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-63667",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T20:05:34.998193Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-17T20:16:44.720",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-63667",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T20:05:34.998193Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T20:05:02.814Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "apostrophe",
              "vendor": "apostrophecms",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 3.6.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T19:56:07.436Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
            },
            {
              "name": "https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a"
            }
          ],
          "source": {
            "advisory": "GHSA-79qf-vqgc-7xx3",
            "discovery": "UNKNOWN"
          },
          "title": "ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-63667",
        "datePublished": "2026-08-17T19:56:07.436Z",
        "dateReserved": "2026-07-17T14:47:08.032Z",
        "dateUpdated": "2026-08-17T20:05:42.231Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-354589

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:26

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:26:12.956726+00:00",
  "id": "EUVD-2026-354589"
}

FKIE_CVE-2026-63667

Vulnerability from fkie_nvd - Published: 2026-08-17 20:16 - Updated: 2026-09-09 21:11

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a
	security-advisories@github.com	https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.6.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2."
    }
  ],
  "id": "CVE-2026-63667",
  "lastModified": "2026-09-09T21:11:46.833",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63667",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-17T20:05:34.998193Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-17T20:16:44.720",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-79QF-VQGC-7XX3

Vulnerability from github – Published: 2026-09-02 14:55 – Updated: 2026-09-02 14:55

Summary

ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

Details

Summary

The @apostrophecms/import-export module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive.

The archive carries an aposAttachments.json file whose name and extension fields are concatenated into a filesystem path with no traversal check. The zip-slip guard that the module applies during tar extraction validates tar entry names only and does not cover this second path, which is built after extraction.

The file at the resulting path is read and copied into the public uploads directory, then served over HTTP without authentication. A ../ sequence in name makes the module read a file outside the extraction directory and publish it at an anonymous URL.

Result: an authenticated contributor reads any file on the host whose name ends in an allowlisted extension (other users' uploaded documents, text or CSV dumps, PDFs) by importing a crafted archive and fetching the planted attachment anonymously.

Affected

apostrophecms/apostrophe with the @apostrophecms/import-export module installed and registered. Module version 3.6.1 (current latest), tested against Apostrophe 4.31.0 (monorepo HEAD 4d478d9). Requires an account with the contributor role or higher; guest and anonymous requests are rejected. The module is not part of the default starter kit, so sites that never installed it are not affected. Files whose real name lacks an accepted file-group extension are not reachable.

Root cause

The import parser builds each attachment's source path by concatenating attacker-controlled JSON fields: lib/formats/gzip.js:46 sets file.path = path.join(attachmentFilesPath, ${attachment._id}-${attachment.name}.${attachment.extension}) from the aposAttachments.json entries in the uploaded archive. That path flows unchanged through lib/methods/import.js:832 (insertAttachments) into lib/methods/import.js:1074 (attachment.insert), where uploadfs copies the referenced file into the public uploads directory served by express.static. The archive's only traversal guard, lib/formats/gzip.js:143 (if (name.includes('../'))), validates tar entry names during extraction and never inspects the name/extension values used to construct the read path, so a name of ../../../../../../tmp/secret escapes attachmentFilesPath. Reaching the sink requires only an authenticated session (lib/methods/import.js:71), view permission on the target type (lib/methods/index.js:54), and the upload-attachment permission enforced at modules/@apostrophecms/attachment/index.js:442, which the built-in contributor role holds. The trailing .${extension} is appended and checked against the file-group allowlist in modules/@apostrophecms/attachment/index.js (getFileGroup), so the target file's real name must end in an accepted extension (txt, csv, pdf, xls, doc, svg, and similar).

Reproduction

Apostrophe 4.31.0 starter-kit-essentials, MongoDB, default roles, @apostrophecms/import-export 3.6.1 installed, local uploadfs backend.

Place a secret file outside the upload tree with an allowlisted extension.

$ cat /tmp/apos_victim_secret.txt
TOP-SECRET DB DUMP
DB_PASSWORD=Pr0d-Secret-9981
API_KEY=sk_live_victim_abcdef

Build a gzip archive whose aposAttachments.json points the attachment name at that file through traversal (aposDocs.json is []).

[{"_id":"evilatt0001","name":"../../../../../../../../../../../../tmp/apos_victim_secret","extension":"txt","title":"loot","docIds":[],"crops":[]}]

As a contributor, import the archive through the module's import action (POST /api/v1/@apostrophecms/<type>/import-export-import), then fetch the created attachment with no session.

$ curl -i http://localhost:3500/uploads/attachments/evilatt0001-apos-victim-secret.txt
HTTP/1.1 200 OK
Content-Type: text/plain; charset=UTF-8

TOP-SECRET DB DUMP
DB_PASSWORD=Pr0d-Secret-9981
API_KEY=sk_live_victim_abcdef

Live-verified: a contributor-driven import reads /tmp/apos_victim_secret.txt (outside the extraction directory) and serves it at an anonymous URL; the same import run as a guest is rejected at the upload-attachment check (modules/@apostrophecms/attachment/index.js:442).

Impact

Read of arbitrary host files whose real name ends in an allowlisted extension (txt, csv, pdf, xls, doc, svg, and similar).
Disclosure of other users' uploaded documents and any allowlisted-extension file readable by the Node process.
The exfiltration target is copied to a public, unauthenticated URL.
Triggered by the contributor role in a single import, no admin interaction.

Credit

Jan Kahmen, turingpoint (jan@turingpoint.de)

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@apostrophecms/import-export"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:55:47Z",
    "nvd_published_at": "2026-08-17T20:16:44Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `@apostrophecms/import-export` module reconstructs the on-disk source path of every imported attachment from JSON metadata contained in the uploaded archive.\n\nThe archive carries an `aposAttachments.json` file whose `name` and `extension` fields are concatenated into a filesystem path with no traversal check. The zip-slip guard that the module applies during tar extraction validates tar entry names only and does not cover this second path, which is built after extraction.\n\nThe file at the resulting path is read and copied into the public uploads directory, then served over HTTP without authentication. A `../` sequence in `name` makes the module read a file outside the extraction directory and publish it at an anonymous URL.\n\nResult: an authenticated contributor reads any file on the host whose name ends in an allowlisted extension (other users\u0027 uploaded documents, text or CSV dumps, PDFs) by importing a crafted archive and fetching the planted attachment anonymously.\n\n## Affected\n\napostrophecms/apostrophe with the `@apostrophecms/import-export` module installed and registered. Module version 3.6.1 (current latest), tested against Apostrophe 4.31.0 (monorepo HEAD 4d478d9). Requires an account with the contributor role or higher; guest and anonymous requests are rejected. The module is not part of the default starter kit, so sites that never installed it are not affected. Files whose real name lacks an accepted file-group extension are not reachable.\n\n## Root cause\n\nThe import parser builds each attachment\u0027s source path by concatenating attacker-controlled JSON fields: `lib/formats/gzip.js:46` sets `file.path = path.join(attachmentFilesPath, ${attachment._id}-${attachment.name}.${attachment.extension})` from the `aposAttachments.json` entries in the uploaded archive. That path flows unchanged through `lib/methods/import.js:832` (`insertAttachments`) into `lib/methods/import.js:1074` (`attachment.insert`), where uploadfs copies the referenced file into the public uploads directory served by `express.static`. The archive\u0027s only traversal guard, `lib/formats/gzip.js:143` (`if (name.includes(\u0027../\u0027))`), validates tar entry names during extraction and never inspects the `name`/`extension` values used to construct the read path, so a `name` of `../../../../../../tmp/secret` escapes `attachmentFilesPath`. Reaching the sink requires only an authenticated session (`lib/methods/import.js:71`), view permission on the target type (`lib/methods/index.js:54`), and the `upload-attachment` permission enforced at `modules/@apostrophecms/attachment/index.js:442`, which the built-in contributor role holds. The trailing `.${extension}` is appended and checked against the file-group allowlist in `modules/@apostrophecms/attachment/index.js` (`getFileGroup`), so the target file\u0027s real name must end in an accepted extension (txt, csv, pdf, xls, doc, svg, and similar).\n\n## Reproduction\n\nApostrophe 4.31.0 starter-kit-essentials, MongoDB, default roles, `@apostrophecms/import-export` 3.6.1 installed, local uploadfs backend.\n\n1. Place a secret file outside the upload tree with an allowlisted extension.\n\n```\n$ cat /tmp/apos_victim_secret.txt\nTOP-SECRET DB DUMP\nDB_PASSWORD=Pr0d-Secret-9981\nAPI_KEY=sk_live_victim_abcdef\n```\n\n2. Build a gzip archive whose `aposAttachments.json` points the attachment `name` at that file through traversal (`aposDocs.json` is `[]`).\n\n```\n[{\"_id\":\"evilatt0001\",\"name\":\"../../../../../../../../../../../../tmp/apos_victim_secret\",\"extension\":\"txt\",\"title\":\"loot\",\"docIds\":[],\"crops\":[]}]\n```\n\n3. As a contributor, import the archive through the module\u0027s import action (`POST /api/v1/@apostrophecms/\u003ctype\u003e/import-export-import`), then fetch the created attachment with no session.\n\n```\n$ curl -i http://localhost:3500/uploads/attachments/evilatt0001-apos-victim-secret.txt\nHTTP/1.1 200 OK\nContent-Type: text/plain; charset=UTF-8\n\nTOP-SECRET DB DUMP\nDB_PASSWORD=Pr0d-Secret-9981\nAPI_KEY=sk_live_victim_abcdef\n```\n\nLive-verified: a contributor-driven import reads `/tmp/apos_victim_secret.txt` (outside the extraction directory) and serves it at an anonymous URL; the same import run as a guest is rejected at the `upload-attachment` check (`modules/@apostrophecms/attachment/index.js:442`).\n\n## Impact\n\n- Read of arbitrary host files whose real name ends in an allowlisted extension (txt, csv, pdf, xls, doc, svg, and similar).\n- Disclosure of other users\u0027 uploaded documents and any allowlisted-extension file readable by the Node process.\n- The exfiltration target is copied to a public, unauthenticated URL.\n- Triggered by the contributor role in a single import, no admin interaction.\n\n## Credit\n\nJan Kahmen, [turingpoint](https://www.turingpoint.de) (jan@turingpoint.de)",
  "id": "GHSA-79qf-vqgc-7xx3",
  "modified": "2026-09-02T14:55:47Z",
  "published": "2026-09-02T14:55:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-79qf-vqgc-7xx3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63667"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/87cccf44a23d09420875ca8a3765eb3db843836a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63667 (GCVE-0-2026-63667)

EUVD-2026-354589

FKIE_CVE-2026-63667

GHSA-79QF-VQGC-7XX3

Summary

Affected

Root cause

Reproduction

Impact

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour