CVE-2026-63667: ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMS import-export moduleto a version that resolves this vulnerability.Fixed in 3.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63667?
CVE-2026-63667 has a medium severity rating of 6.5.
How do I fix CVE-2026-63667?
To mitigate CVE-2026-63667, upgrade to ApostropheCMS version 3.6.2 or later.
What type of vulnerability is CVE-2026-63667?
CVE-2026-63667 is a path traversal vulnerability affecting the import-export module of ApostropheCMS.
What systems are affected by CVE-2026-63667?
CVE-2026-63667 affects versions of ApostropheCMS prior to version 3.6.2.
What are the potential impacts of CVE-2026-63667?
Exploitation of CVE-2026-63667 could allow an attacker to read arbitrary files from the server.