{"id":"EUVD-2026-105211","revision":null,"records":[{"revision":"814d4944dfeb4863908aac07d2895e67","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-113664","aliases":[],"title":"ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.","state":0,"publishedAt":"2026-10-20T17:15:01.932+00:00","modifiedAt":"2026-10-23T01:56:12.528+00:00","affected":[{"ecosystem":"Vendor product","name":"apostrophe","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"apostrophecms\",\n                    \"product\": \"apostrophe\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.33.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"import-export","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@apostrophecms\",\n                    \"product\": \"import-export\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.7.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113664","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-113664","identifiers":["CVE-2026-113664"]},"retained":false,"historicalAffected":[]},{"revision":"d0c3a3dbc5ac46208b313bc66da09e65","observedAt":"2026-11-07T04:34:30.213+00:00","statement":{"source":"euvd","id":"EUVD-2026-105211","aliases":["CVE-2026-113664","GHSA-97wv-p4xx-c7mg"],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal par…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3,"severity":null}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105211","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 5:15:01 PM","dateUpdated":"Oct 23, 2026, 1:56:12 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105211","identifiers":["EUVD-2026-105211","CVE-2026-113664","GHSA-97wv-p4xx-c7mg"]},"retained":false,"historicalAffected":[]},{"revision":"03e88d4d5d574b8c8a8d81d4ad242a9f","observedAt":"2026-10-25T05:17:18.597+00:00","statement":{"source":"nvd","id":"CVE-2026-113664","aliases":[],"title":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal par…","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.","state":0,"publishedAt":"2026-10-20T18:17:19.86+00:00","modifiedAt":"2026-10-23T02:16:56.33+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113664","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T18:17:19.860","lastModified":"2026-10-23T02:16:56.330"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-113664","identifiers":["CVE-2026-113664"]},"retained":false,"historicalAffected":[]},{"revision":"e560fe4d75894237a61a2d0b1261f5b0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-97wv-p4xx-c7mg","aliases":["CVE-2026-113664"],"title":"ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test","description":"### Summary\n\nThe tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.\n\nConfirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.\n\n### Details\n\n`packages/import-export/lib/formats/gzip.js`, in the tar-stream `entry` handler inside `extract(filepath, exportPath)`:\n\n```js\nconst name = header.name.replace(/\\\\/g, '/');\nif (name.includes('../')) {\n  // skipped\n}\n...\nstream.pipe(fs.WriteStream(path.join(exportPath, name)));\n```\n\nTwo separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no `error` handler, so any stream error becomes an unhandled `'error'` event.\n\nReaching it needs an account that can import, nothing more. `packages/import-export/modules/@apostrophecms/import-export-page/index.js` exposes `post.importExportImport`, which calls into `lib/methods/import.js`; that handler requires `req.user` and then calls `format.input(exportPath)`, which for a `.gz` upload is `gzip.js` calling `extract()` on the uploaded archive.\n\n### PoC\n\nThis is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from `post.importExportImport` to `extract()` was read, not observed.\n\nThe guard misses the payload:\n\n```bash\nnode -e \"console.log('./..'.includes('../')); console.log('..'.includes('../')); console.log('a/./..'.includes('../'));\"\n```\n\n```text\nfalse\nfalse\nfalse\n```\n\n`path.join` then resolves it out of the export directory:\n\n```bash\nnode -e \"const path=require('path'); const exportPath='/tmp/exportRoot'; console.log(path.join(exportPath,'./..'));\"\n```\n\n```text\n/tmp\n```\n\nAnd a write stream opened on a directory, with no `error` listener, kills the process rather than failing the request:\n\n```bash\nnode -e \"const fs=require('fs'); const s=fs.createWriteStream('/tmp'); s.write('x'); s.end(); setTimeout(()=>console.log('still alive'),500);\"\n```\n\n```text\nevents.js:291\n      throw er; // Unhandled 'error' event\n      ^\n\nError: EISDIR: illegal operation on a directory, open '/tmp'\nEmitted 'error' event on WriteStream instance at:\n    at internal/fs/streams.js:361:12\n    at FSReqCallback.oncomplete (fs.js:156:23) {\n  errno: -21,\n  code: 'EISDIR',\n  syscall: 'open',\n  path: '/tmp'\n}\n```\n\nThe `events.js:291` frame shows that transcript came off the Node 14 line my audit box had. The unhandled-`error`-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run.\n\nSource-side confirmation without running anything:\n\n```bash\ngrep -n \"includes('../')\" packages/import-export/lib/formats/gzip.js\ngrep -n \"WriteStream\" packages/import-export/lib/formats/gzip.js\n```\n\n### Impact\n\nAn authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way.\n\n### Suggested fix\n\nResolve the target and require containment, and attach an error handler:\n\n```js\nconst base = path.resolve(exportPath);\nconst target = path.resolve(path.join(exportPath, name));\n\nif (target !== base && !target.startsWith(base + path.sep)) {\n  stream.on('end', next);\n  stream.resume();\n  return;\n}\n\nif (header.type === 'directory') {\n  fsp.mkdir(target).then(next).catch(reject);\n} else {\n  const out = fs.WriteStream(target);\n  out.on('error', reject);\n  stream.pipe(out);\n  stream.on('end', next);\n}\n```\n\nThe error handler earns its place independently. Any tar entry that lands on an existing directory name has the same effect whether or not traversal is involved.\n\n### Why this is not GHSA-mwxc-m426-3f78\n\nThe `name.includes('../')` check is the mitigation shipped for GHSA-mwxc-m426-3f78 / CVE-2026-32731. It stops names carrying the literal `../` sequence. It does not canonicalize the joined path, so `./..` and a bare `..` still get through, and it did not touch the missing `error` listener. This report is about what the substring test leaves behind.\n\n\nAI assistance was used for the code audit and drafting. The exact guard and `WriteStream` lines in `packages/import-export/lib/formats/gzip.js` at the stated HEAD were manually verified, the import route from the page module through `lib/methods/import.js` into the entry handler were manually traced, and the three Node one-liners were manually ran and copied verbatim.","state":0,"publishedAt":"2026-10-20T18:23:42+00:00","modifiedAt":"2026-10-20T18:30:04.6140265+00:00","affected":[{"ecosystem":"npm","name":"@apostrophecms/import-export","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.7.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg","https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce","https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350","https://github.com/apostrophecms/apostrophe","https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0"],"sourceUrl":"https://github.com/advisories/GHSA-97wv-p4xx-c7mg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-97wv-p4xx-c7mg","identifiers":["GHSA-97wv-p4xx-c7mg","CVE-2026-113664"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0239033+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0239043+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-83dbcd705162368a7389ef21c7d5877b90bc9ecd8679671f4b5e02683a8e1d4f","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T06:06:40.5628876+00:00","lastSuccessAt":"2026-11-08T06:06:40.5495855+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.5628876+00:00","snapshotPublishedAt":"2026-11-08T05:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T06:07:06.8623217+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0246874+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0246876+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f61a222d691b4992bb1403f1a88575db","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T06:07:06.2347163+00:00","lastSuccessAt":"2026-11-08T06:07:06.231+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:07:06.231+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T06:06:40.830411+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.830411+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T06:06:40.6194681+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.6194681+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T06:06:40.8424247+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.8424247+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T06:06:40.7260451+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.7260451+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}