ApostropheCMS's import-export module allowed an authenticated importer to supply a tar entry whose normalized destination path pointed to a directory, bypassing a literal parent-path substring guard that checked for "../". When the extraction process attempted to open that directory for writing, it emitted an unhandled filesystem error that caused the Node.js process to crash. The flaw does not provide direct arbitrary file read or write capability, but it can result in denial of service for the affected instance.

The vulnerability affects ApostropheCMS and its import-export module (versions prior to 3.7.0). The issue is limited to authentication levels capable of initiating imports. No other vendors or product lines are affected.

The CVSS v3 score of 5.3 indicates moderate severity. Exploitation requires legitimate access to the import feature; anonymous access is insufficient. Since the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the likelihood of widescale exploitation appears lower, but it remains a notable risk for websites that run unpatched ApostropheCMS deployments.