{"id":"EUVD-2026-105211","enisaUuid":"bae7d7d7-cbbf-36ea-af61-a34c66b00f5d","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.","datePublished":"Oct 20, 2026, 5:15:01 PM","dateUpdated":"Oct 23, 2026, 1:56:12 AM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0\n","aliases":"CVE-2026-113664\nGHSA-97wv-p4xx-c7mg\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"87aa24fc-1d35-33ec-9d30-b69e539f5c23","product":{"name":"import-export","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 3.7.0"},{"id":"a931a596-b2a6-3020-9535-cc26f1b2b42e","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"enisaIdVendor":[{"id":"4bdb4316-3b66-3538-8cf3-c54a3a129717","vendor":{"name":"apostrophecms"}},{"id":"b963f283-0b26-32a5-b9b3-1c222657919e","vendor":{"name":"@apostrophecms"}}],"enisaIdVulnerability":[{"id":"0d687b16-227f-385b-95c5-4afec85b0328","vulnerability":{"id":"CVE-2026-113664","description":"ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.","datePublished":"Oct 20, 2026, 5:15:01 PM","dateUpdated":"Oct 23, 2026, 1:56:12 AM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0\n","enisa_id":"EUVD-2026-105211\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Nov 2, 2026, 7:15:26 AM","vulnerabilityProduct":[{"id":"8904a231-bcb1-3c65-a4f0-2a27abc1a86a","product":{"name":"import-export","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 3.7.0"},{"id":"a9319c33-2f3a-3f39-9595-57a52c4c99d1","product":{"name":"Apostrophe ","vendor":{"name":"apostrophecms"}},"product_version":"\u003c 4.33.0"}],"vulnerabilityVendor":[{"id":"3909fdc9-d077-3782-815d-922c10edb85e","vendor":{"name":"apostrophecms"}},{"id":"8db2a1c2-5ea5-3a84-9458-0f9d718ac95a","vendor":{"name":"@apostrophecms"}}]}},{"id":"e33c8682-966d-33c5-9d96-9618b724eba3","vulnerability":{"id":"GHSA-97wv-p4xx-c7mg","description":"ApostropheCMS import-export tar guard misses \u0027./..\u0027 because it is a literal \u0027../\u0027 substring test","datePublished":"Oct 20, 2026, 6:23:42 PM","dateUpdated":"Oct 20, 2026, 6:23:42 PM","baseScore":0.0,"references":"https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg\nhttps://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce\nhttps://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350\nhttps://github.com/apostrophecms/apostrophe\nhttps://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0\n","enisa_id":"EUVD-2026-105211\n","aliases":"CVE-2026-113664\nGHSA-97wv-p4xx-c7mg\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:08:27 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}