CyberRota Analysis
AI-GeneratedThe import-export module in ApostropheCMS versions prior to 3.6.2 is vulnerable to path traversal attacks due to improper validation of user-controlled input when constructing attachment source paths. This flaw allows authenticated contributors to import malicious archives, potentially leading to unauthorized access and exposure of sensitive files on the server. Organizations using affected versions should prioritize upgrading to 3.6.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.