The flaw exists in the import-export component of ApostropheCMS, where an uploaded archive can specify an attachment source path derived from attacker-controlled identifiers. The lack of path validation allows a contributor with import privileges to fabricate an archive that reads host files whose extensions match allowed types and copies them into the attachments directory. The vendor addresses the flaw in version 3.6.2, before which the attacker can read confidential or system files and then publish those files at an unauthenticated uploads URL, thereby exposing the contents to the public.

All installations of ApostropheCMS using the import-export module with versions earlier than 3.6.2. The vulnerability is tied specifically to modules in packages/import-export/lib/formats/gzip.js and is relevant to contributors who can import archives via the user interface.

The CVSS score is 6.5, indicating moderate severity. No EPSS metric is available, but the vulnerability is not listed in CISA KEV. Because the attack requires authenticated contributor access, a potential attacker would need valid credentials and sufficient rights to invoke the import-export function. Once the path traversal is leveraged, the attacker can read arbitrary host files with permitted extensions and subsequently expose those copies to all users through the public upload path. The combination of moderate industry severity and the prerequisite of contributor privileges makes the risk significant for organizations that grant such users upload rights.