ApostropheCMS EUVD-2026-105211

Requires (1) the @apostrophecms/import-export module to be installed and enabled, (2) an authenticated account with permission to perform imports (PR:L - not an anonymous attacker), and (3) the ability to submit a crafted tar archive whose normalized destination resolves to a directory, defeating the pre-3.7.0 literal parent-path substring guard. Limiting factors: exploitation is impossible without valid importer credentials and without the separately-installed import-export module; impact is confined to a denial-of-service process crash, as the advisory states no controlled arbitrary file read/write was achieved.

This is a medium-severity (CVSS 4.0 base 5.3), authenticated issue with no amplifying threat signals: no EPSS score, KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis.' The CVSS vector is PR:L/UI:N/AV:N, meaning a logged-in user holding import privileges can trigger it remotely without user interaction, but required authentication materially caps the attacker population. The supplied CVSS 4.0 vector claims balanced low impact across all three dimensions (VC:L/VI:L/VA:L), yet the description contradicts this: it explicitly states the researcher established only a static DoS primitive (an unhandled filesystem error that terminates the Node.js process) and NOT a controlled arbitrary file read or write and NOT an end-to-end exploit. The realistic impact is therefore availability (process crash), with confidentiality and integrity impact unproven - the input vector appears to overstate C/I. Net assessment: a genuine but low-priority defense-in-depth fix, not an emergency; it is an authenticated denial-of-service in a niche optional module, not a widespread pre-auth RCE.

An authenticated user with import permissions uploads a crafted tar archive to the import-export module whose entry path normalizes to a directory while slipping past the literal parent-path substring check. When the importer opens that path as a write stream, the resulting filesystem error is unhandled and terminates the Node.js process, denying service to all users. No public proof-of-concept was provided, and the source only demonstrates the crash primitive rather than file read/write.