Executive brief
ApostropheCMS's import-export module, used to bulk import content archives, fails to validate file paths when reconstructing attachment sources from archive metadata. An authenticated contributor can craft a malicious import archive with path-traversal sequences (../) in attachment filenames to read arbitrary files outside the intended directory and serve them as public URLs without authentication. This exposes sensitive files like database credentials, API keys, and other users' documents.
Technical details
The @apostrophecms/import-export module builds the source path for imported attachments by directly concatenating attacker-controlled JSON fields from the archive's aposAttachments.json: `path.join(attachmentFilesPath, ${attachment._id}-${attachment.name}.${attachment.extension})`. Although the module implements a zip-slip guard that checks tar entry names for `../` during extraction, this validation does not cover the second path constructed from JSON metadata. By using `../` sequences in the `name` field, an attacker bypasses the extraction directory boundaries and reads arbitrary files from the host filesystem. The exploited file is then copied into the public uploads directory served by express.static, making it anonymously accessible via HTTP. Exploitation requires only an authenticated contributor-level account (view permission on the target type and the built-in `upload-attachment` permission), though guest and anonymous requests are rejected. Files reachable must end in an allowlisted extension (txt, csv, pdf, xls, doc, svg, etc.); the extension validation acts as an implicit filter but does not prevent traversal itself.
Affected products
- ApostropheCMS @apostrophecms/import-export <= 3.6.1
Timeline
- 2026-08-17: disclosed: Published to NVD
- 2026-09-02: disclosed: Published to GitHub Advisory Database
- 2026: patched: Patched in version 3.6.2