ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

Vulnerability

Overview

The extract() function in gzip.js of the @apostrophecms/import-export package constructs file-write paths using fs.createWriteStream(path.join(exportPath, header.name)). The path.join() method does not sanitize traversal segments such as ../, so a tar entry named ../../evil.js resolves to a path outside the intended extraction directory. No canonical-path check is performed before opening the write stream, resulting in a classic Zip Slip vulnerability (CWE-22) [1].

Exploitation

Prerequisites

Any user with the Global Content Modify permission—a role routinely assigned to content editors and site managers—can exploit this flaw. The attacker uploads a crafted .tar.gz file through the standard CMS import UI. The extraction process then writes attacker-controlled content to any path the Node.js process can access on the host filesystem [1].

Impact

Successful exploitation enables arbitrary file write, which can lead to remote code execution (e.g., overwriting application files), website defacement by writing to the static web directory (public/), or injection of malicious assets. The CVSS v3.1 score is 9.1 (Critical) with a network attack vector, low complexity, and no user interaction required beyond the initial authenticated upload [1].

Mitigation

The vulnerability is fixed in version 3.5.3 of @apostrophecms/import-export. Users should update immediately. No workarounds are documented; the fix involves proper path sanitization and canonical-path validation before writing extracted files [1].