ApostropheCMS RCE (CVE-2026-32731) [PoC]

Overview

A critical security vulnerability, identified as CVE-2026-32731, has been discovered in the @apostrophecms/import-export module for ApostropheCMS. This flaw is a classic “Zip Slip” vulnerability that could allow an authenticated attacker to write malicious files to any location accessible by the Node.js server process.

Vulnerability Details

The vulnerability exists in the extract() function within the module’s gzip.js file. When processing uploaded .tar.gz files, the code uses the path.join() method to construct the destination path for extracted files. This method does not prevent or sanitize directory traversal sequences like ../. Consequently, a malicious archive containing a file named ../../evil.js would cause the system to write that file outside the intended extraction directory, potentially to critical system locations.

Impact and Risk

The impact of this vulnerability is severe (CVSS Score: 9.9). Any CMS user with the “Global Content Modify” permission-a standard role for editors and site managers-can exploit this flaw through the normal import interface. Successful exploitation could lead to:

• Remote Code Execution (RCE) by overwriting application files.
• System compromise and complete server takeover.
• Data theft or destruction by accessing sensitive files.
• Website defacement or persistent backdoor installation.

This vulnerability underscores the risks of insufficient input validation in file operations. For context on how such flaws can lead to major incidents, you can review historical breach reports.

Remediation and Mitigation

The primary and mandatory action is to update the @apostrophecms/import-export module immediately.

Action Required:

1. Patch: Upgrade the @apostrophecms/import-export module to version 3.5.3 or later. This version fixes the path traversal issue.
2. Verify: Confirm that no unauthorized file changes have occurred on your server since the last known-good state.
3. Principle of Least Privilege: Audit and minimize user accounts with the “Global Content Modify” permission. Only essential administrators should hold this role.

Temporary Mitigation (if patching is delayed):

• Disable the import functionality or the entire @apostrophecms/import-export module if it is not in active use.
• Closely monitor server file systems for unexpected changes.

Staying informed on such critical updates is crucial for maintaining security. For the latest on vulnerabilities and patches, follow our security news coverage. Organizations using ApostropheCMS should treat this patch as an urgent priority to prevent potential system compromise.