CVE-2026-32731:
ApostropheCMS import-export module vulnerable to Zip Slip attack, allowing arbitrary file write.
Score
A numerical rating that indicates how dangerous this vulnerability is.
9.9Critical- Published Date:Mar 18, 2026
- CISA KEV Date:*No Data*
- Industries Affected:20
Exploitability
- Score:3.1
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:LOW
- User Interaction:NONE
- Scope:CHANGED
Impact
- Score:6.0
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
ApostropheCMS import-export module vulnerable to Zip Slip attack, allowing arbitrary file write.
Overview
The vulnerability affects ApostropheCMS versions prior to 3.5.3 of the @apostrophecms/import-export module. The issue stems from improper handling of file paths during the extraction process of imported archives. The extract() function in gzip.js uses path.join() without sanitizing traversal segments, allowing malicious actors to write files outside the intended directory. This vulnerability is particularly dangerous as it can be exploited by users with content editing privileges, a common role in CMS environments. The CVSS v3.1 score for this vulnerability is 9.9 (Critical), indicating a severe risk. The attack vector is network-based, requires low complexity and privileges, and can be executed without user interaction. The potential impact on confidentiality, integrity, and availability is high, with the scope extending beyond the vulnerable component.
Remediation
- To address this vulnerability, organizations using ApostropheCMS should immediately upgrade to version 3.5.3 or later of the @apostrophecms/import-export module. If immediate upgrading is not possible, consider temporarily disabling import functionality or restricting access to users with Global Content Modify permissions until the update can be applied.
- Additionally, implement the following security measures:
- 1. Regularly audit user permissions, especially those with content modification rights.
- 2. Monitor system logs for suspicious file operations or unexpected file creations.
- 3. Implement strict input validation for all file uploads and imports.
- 4. Consider using application whitelisting to prevent execution of unauthorized files.
References
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
