Path Traversal Vulnerability in ApostropheCMS Affecting Node.js Content Management System

CVE-2026-63667

What is CVE-2026-63667?

ApostropheCMS, an open-source Node.js content management system, contains a path traversal vulnerability in its import-export module. Specifically, versions prior to 3.6.2 allow an authenticated contributor to exploit this defect. By manipulating the _id, name, and extension fields in the aposAttachments.json file, attackers can craft a misleading archive. This could lead to unauthorized access to host files with permitted extensions, allowing the attacker to publish copied files at an unauthenticated uploads URL. Users are strongly advised to update to version 3.6.2 or later, which addresses and mitigates this issue.

References