CVE-2026-113664

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.0

Description An authenticated user with import privileges can cause a denial of service by uploading a specially crafted tar archive. The issue exists because the system uses a literal substring check for ../ to prevent path traversal, which can be bypassed using sequences like ./... When such an entry is processed, path.join normalizes the destination to a directory outside the intended export path. Because the fs.WriteStream in the extract() function lacks an error listener, attempting to open a directory as a write stream triggers an unhandled EISDIR error, which terminates the Node.js process.

Recommendations Update the import-export module to version 3.7.0. As a temporary mitigation, restrict import privileges to only trusted users to minimize the risk of a denial of service attack.