CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
An authenticated contributor can exploit path traversal in the import-export module to read arbitrary host files and publish them publicly.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63667?
CVE-2026-63667 is a medium-severity path traversal vulnerability in apostrophecms apostrophe, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled _id, name, and extension fields in aposAttachments.json without ensuring that the resolved path remains under the extracted attachments directory, allowing an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. This issue is fixed in version 3.6.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-63667?
2 open source packages ship an affected version, including @apostrophecms/import-export.
| Package | Affected | Fixed in |
|---|---|---|
@apostrophecms/import-export npm | All versions | 3.6.2 |
@apostrophecms/import-export npm | All versions | 3.6.2 |
How do I fix CVE-2026-63667?
Upgrade @apostrophecms/import-export to 3.6.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-63667 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63667 exists.
Sources
Also known as GHSA-79qf-vqgc-7xx3.