ApostropheCMS suffered a zip slip vulnerability in the import‑export module where the Gzip extraction logic concatenates archive entry names with the target directory without sanitising them. An attacker can craft a payload containing traversal sequences such as "../../evil.js" which, when processed, is written to arbitrary paths reachable by the Node.js process. By overwriting configuration files, server-side scripts, or executable binaries the attacker can gain full control of the application or host, compromising confidentiality, integrity, and availability.

The flaw exists in the @apostrophecms/import-export package for all releases prior to v3.5.3. Users who possess Global Content Modify permissions – typically editors or site managers – can trigger the vulnerability through the CMS import interface. The affected component runs under the Node.js environment and can write anywhere within the process’s file‑system access rights.

The CVSS rating is 10, indicating a critical impact. EPSS shows less than 1% probability of exploitation in the wild, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog. The attack requires authenticated access with content‑modify rights and the ability to upload a .tar.gz file; once the credentials are in place, the exploit is straightforward and does not demand additional privileges. The path traversal flaw can be leveraged to achieve remote code execution, making it highly exploitable for attackers with moderate access within the CMS.