ApostropheCMS EUVD-2026-60441

Exploitation requires an authenticated account with at least the contributor role on the target ApostropheCMS instance - unauthenticated access is not sufficient. The @apostrophecms/import-export module must be installed and the import endpoint must be accessible to the attacker's account. Only host files whose filenames end in an extension permitted by the CMS's attachment allow-list (such as .txt, .csv, .pdf, .jpg, .png) can be targeted; files with non-allowed extensions or no extension cannot be read via this vector. The attack reads files but does not write, modify, or execute them, ruling out direct code execution or privilege escalation. The existing zip-slip guard on tar entry names during extraction is bypassed because this vulnerability operates on a second, post-extraction path construction step that was not covered by the guard.

The NVD CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 and is well-calibrated for this vulnerability: network-accessible exploitation by a contributor-level authenticated user with no additional complexity. The high confidentiality impact reflects that targeted files are not only read but actively published to a public, unauthenticated URL - a meaningful escalation beyond simple server-side disclosure. A key limiting factor is the allow-list extension constraint: only files whose names end in permitted extensions (e.g., .txt, .csv, .pdf, .jpg) can be targeted, reducing the scope compared to fully unrestricted traversal. No EPSS score was provided; no CISA KEV listing or public proof-of-concept exists at time of analysis, indicating this has not yet seen opportunistic exploitation. Real-world priority is moderate-to-high specifically for deployments where contributor accounts are granted to untrusted third parties - a common CMS scenario - and where sensitive configuration or data files with allowed extensions are present on the host. The commit diff also reveals two co-fixed issues in the same release (MongoDB operator injection via EJSON and a DoS hang in the tar extractor), suggesting this CVE is part of a broader internal security review rather than a targeted exploit report.

An attacker with a contributor account crafts a .tar.gz archive in which aposAttachments.json contains an entry with _id set to ../../etc, name set to hostname, and extension set to txt. Upon uploading and triggering the import, ApostropheCMS reconstructs the source path as resolving to /etc/hostname (or an analogous sensitive file with an allowed extension) outside the extraction directory, reads the file, and copies its contents to a public uploads URL accessible without authentication. No public proof-of-concept is known at time of analysis, but the attack requires only standard archive-crafting tools and a contributor account.