CVE-2026-63667

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 3.6.2

Description The import-export module in packages/import-export/lib/formats/gzip.js fails to properly validate that the resolved attachment source path remains within the extracted attachments directory. An authenticated contributor can exploit this by importing a crafted archive with manipulated id, name, and extension fields in aposAttachments.json. This path traversal allows the attacker to read host files with allowed extensions and publish them via an unauthenticated uploads URL.

Recommendations Update to version 3.6.2.