Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-113664 · GHSA-97wv-p4xx-c7mg

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

Risk score
45/100
CVSS
5.3 v4.0
Exploit chance (30 days)
0.5%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unh…
Affected
@apostrophecms/import-export (npm) < 3.7.0
Fix
Upgrade @apostrophecms/import-export to 3.7.0 or later.
Exploitation
No known exploitation

Story map

Story map: @apostrophecms/import-exportTHE FLAWSTHE FIXCVE-2026-113664ApostropheCMS import-exporttar guard misses './..' becauseit is a literal '../' substring…CVSS 5.3 · EPSS 0%CVE-2026-112953ApostropheCMS: Exposure ofSensitive Information viapredictable export filenamesCVSS 6.0 · EPSS 1%CVE-2026-112955ApostropheCMS: Importarchives can exhaust serverstorage and deny serviceCVSS 6.5 · EPSS 1%CVE-2026-112956ApostropheCMS: Archiveduplicate continuation letscontributors overwrite…CVSS 6.5 · EPSS 0%Upgrade…3.7.0 · 3.7.1or later on your release lineWho is exposed@apostrophecms/import-export (npm) < 3.7.1YELLOW · PLAN IT IN@apostrophecms/import-exportApostropheCMS is anopen-source Node.js contentmanagement system. Prior to3.7.1 of the import-exportmodule, predictable exportarchive filenames allow anunauthenticated requester to…Where it standsPublic proof of conceptCONNECTS TOSame weaknessPath traversal (CWE-22)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@apostrophecms/import-export: Yellow, plan it in. ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export per…

The flaws

  • CVE-2026-113664: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test (CVSS 5.3 · EPSS 0%)
  • CVE-2026-112953: ApostropheCMS: Exposure of Sensitive Information via predictable export filenames (CVSS 6.0 · EPSS 1%)
  • CVE-2026-112955: ApostropheCMS: Import archives can exhaust server storage and deny service (CVSS 6.5 · EPSS 1%)
  • CVE-2026-112956: ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content (CVSS 6.5 · EPSS 0%)

The fix

Upgrade @apostrophecms/import-export: 3.7.0 · 3.7.1 or later on your release line

Who is exposed: @apostrophecms/import-export (npm) < 3.7.1

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@apostrophecms/import-exportnpm< 3.7.03.7.0

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.