CVE-2026-113664

CVE-2026-113664 · ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

CVSS 5.3 · Moyenne · EPSS 0,5% · Code d’exploitation public · Correctif disponible

Publication

2026-10-20T17:15:01.932Z

Mise à jour

2026-10-23T01:56:12.528Z

Pile logicielle: node

Vérifiez votre serveur →