CVE-2026-63667: ApostropheCMS import-export path traversal arbitrary file read

CVE-2026-63667 · Severity: medium · CVSS 6.5 · Published 2026-08-17

ApostropheCMS's import-export module, used to bulk import content archives, fails to validate file paths when reconstructing attachment sources from archive metadata. An authenticated contributor can craft a malicious import archive with path-traversal sequences (../) in attachment filenames to read arbitrary files outside the intended directory and serve them as public URLs without authentication. This exposes sensitive files like database credentials, API keys, and other users' documents.

Technologies: ApostropheCMS Import-Export, @apostrophecms/import-export (npm). Vendors: ApostropheCMS, npm.

Quick answers

Is CVE-2026-63667 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63667 being exploited in the wild.
How severe is CVE-2026-63667?
Medium severity, with a CVSS score of 6.5, published 17 August 2026.
Which products and versions are affected?
ApostropheCMS Import-Export <= 3.6.1; @apostrophecms/import-export (npm) <= 3.6.1, SEMVER:introduced=0,fixed=3.6.2.
Is there a fix for CVE-2026-63667?
Yes. @apostrophecms/import-export (npm): upgrade to 3.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63667 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63667?
Check whether you run ApostropheCMS Import-Export or @apostrophecms/import-export (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @apostrophecms/import-export (npm): upgrade to 3.6.2 or later
    npm install @apostrophecms/import-export@3.6.2

Technical details

The @apostrophecms/import-export module builds the source path for imported attachments by directly concatenating attacker-controlled JSON fields from the archive's aposAttachments.json: `path.join(attachmentFilesPath, ${attachment._id}-${attachment.name}.${attachment.extension})`. Although the module implements a zip-slip guard that checks tar entry names for `../` during extraction, this validation does not cover the second path constructed from JSON metadata. By using `../` sequences in the `name` field, an attacker bypasses the extraction directory boundaries and reads arbitrary files from the host filesystem. The exploited file is then copied into the public uploads directory served by express.static, making it anonymously accessible via HTTP. Exploitation requires only an authenticated contributor-level account (view permission on the target type and the built-in `upload-attachment` permission), though guest and anonymous requests are rejected. Files reachable must end in an allowlisted extension (txt, csv, pdf, xls, doc, svg, etc.); the extension validation acts as an implicit filter but does not prevent traversal itself.

Affected products

  • ApostropheCMS @apostrophecms/import-export <= 3.6.1

Identifiers

  • CVE-2026-63667
  • GHSA-79qf-vqgc-7xx3

Timeline

  • 2026-08-17: disclosed: Published to NVD
  • 2026-09-02: disclosed: Published to GitHub Advisory Database
  • 2026: patched: Patched in version 3.6.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.