CVE-2026-32731
ApostropheCMS is an open-source content management framework.
Published Mar 18, 2026 · updated Jun 17, 2026 · apostrophecms import-export
ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of , The function in constructs file-write paths using . does not resolve or sanitise traversal segments such as . It concatenates them as-is, meaning a tar entry named resolves to a path outside the intended extraction directory. No canonical-path check is performed before the write stream is opened. This is a textbook Zip Slip vulnerability. Any user who has been granted the Global Content Modify permission — a role routinely assigned to content editors and site managers — can upload a crafted file through the standard CMS import UI and write attacker-controlled content to any path the Node.js process can reach on the host filesystem. Version 3.5.3 of fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 18, 2026 · NIST NVD
Detected
ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of , The function in constructs file-write paths using . does not resolve or sanitise traversal segments such as . It concatenates them as-is, meaning a tar entry named resolves to a path outside the intended extraction directory. No canonical-path check is performed before the write stream is opened. This is a te
Jun 17, 2026 · NIST NVD
Updated
ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of , The function in constructs file-write paths using . does not resolve or sanitise traversal segments such as . It concatenates them as-is, meaning a tar entry named resolves to a path outside the intended extraction directory. No canonical-path check is performed before the write stream is opened. This is a te
Affected
- cpe apostrophecms/import-exportversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-32731
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-32731
ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of , The function in constructs file-write paths using . does not resol
nvd.nist.gov