Directory Traversal Vulnerability in ApostropheCMS Import-Export Module

CVE-2026-113664

What is CVE-2026-113664?

A directory traversal vulnerability exists in the import-export module of ApostropheCMS, allowing an authenticated importer to submit a tar entry that targets a directory by bypassing existing substring guards. This can lead to an unhandled filesystem error when the directory is opened as a write stream, potentially causing the Node.js process to terminate unexpectedly. While this issue does not allow for complete control over arbitrary file read or write actions, it presents a risk of disruption in application functionality. The vulnerability has been addressed in version 3.7.0 of the import-export module.

References