ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

Source published

20 Oct 2026 17:15:01 UTC

Source modified

23 Oct 2026 01:56:12 UTC

Observed here

23 Oct 2026 16:01:20 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

Source published

Oct 20, 2026, 5:15:01 PM (timezone not stated)

Source modified

Oct 23, 2026, 1:56:12 AM (timezone not stated)

Observed here

7 Nov 2026 04:34:30 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

Source published

20 Oct 2026 18:17:19 UTC

Source modified

23 Oct 2026 02:16:56 UTC

Observed here

25 Oct 2026 05:17:18 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary The tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process. Confirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`. ### Details `packages/import-export/lib/formats/gzip.js`, in the tar-stream `entry` handler inside `extract(filepath, exportPath)`: ```js const name = header.name.replace(/\\/g, '/'); if (name.includes('../')) { // skipped } ... stream.pipe(fs.WriteStream(path.join(exportPath, name))); ``` Two separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no `error` handler, so any stream error becomes an unhandled `'error'` event. Reaching it needs an account that can import, nothing more. `packages/import-export/modules/@apostrophecms/import-export-page/index.js` exposes `post.importExportImport`, which calls into `lib/methods/import.js`; that handler requires `req.user` and then calls `format.input(exportPath)`, which for a `.gz` upload is `gzip.js` calling `extract()` on the uploaded archive. ### PoC This is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from `post.importExportImport` to `extract()` was read, not observed. The guard misses the payload: ```bash node -e "console.log('./..'.includes('../')); console.log('..'.includes('../')); console.log('a/./..'.includes('../'));" ``` ```text false false false ``` `path.join` then resolves it out of the export directory: ```bash node -e "const path=require('path'); const exportPath='/tmp/exportRoot'; console.log(path.join(exportPath,'./..'));" ``` ```text /tmp ``` And a write stream opened on a directory, with no `error` listener, kills the process rather than failing the request: ```bash node -e "const fs=require('fs'); const s=fs.createWriteStream('/tmp'); s.write('x'); s.end(); setTimeout(()=>console.log('still alive'),500);" ``` ```text events.js:291 throw er; // Unhandled 'error' event ^ Error: EISDIR: illegal operation on a directory, open '/tmp' Emitted 'error' event on WriteStream instance at: at internal/fs/streams.js:361:12 at FSReqCallback.oncomplete (fs.js:156:23) { errno: -21, code: 'EISDIR', syscall: 'open', path: '/tmp' } ``` The `events.js:291` frame shows that transcript came off the Node 14 line my audit box had. The unhandled-`error`-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run. Source-side confirmation without running anything: ```bash grep -n "includes('../')" packages/import-export/lib/formats/gzip.js grep -n "WriteStream" packages/import-export/lib/formats/gzip.js ``` ### Impact An authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way. ### Suggested fix Resolve the target and require containment, and attach an error handler: ```js const base = path.resolve(exportPath); const target = path.resolve(path.join(exportPath, name)); if (target !== base && !target.startsWith(base + path.sep)) { stream.on('end', next); stream.resume(); return; } if (header.type === 'directory') { fsp.mkdir(target).then(next).catch(reject); } else { const out = fs.WriteStream(target); out.on('error', reject); stream.pipe(out); stream.on('end', next); } ``` The error handler earns its place independently. Any tar entry that lands on an existing directory name has the same effect whether or not traversal is involved. ### Why this is not GHSA-mwxc-m426-3f78 The `name.includes('../')` check is the mitigation shipped for GHSA-mwxc-m426-3f78 / CVE-2026-32731. It stops names carrying the literal `../` sequence. It does not canonicalize the joined path, so `./..` and a bare `..` still get through, and it did not touch the missing `error` listener. This report is about what the substring test leaves behind. AI assistance was used for the code audit and drafting. The exact guard and `WriteStream` lines in `packages/import-export/lib/formats/gzip.js` at the stated HEAD were manually verified, the import route from the page module through `lib/methods/import.js` into the entry handler were manually traced, and the three Node one-liners were manually ran and copied verbatim.

Source published

20 Oct 2026 18:23:42 UTC

Source modified

20 Oct 2026 18:30:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Publisher rating · MODERATE