ApostropheCMS é um framework de gerenciamento de conteúdo de código aberto. Anterior à versão 3.5.3 do `@apostrophecms/import-export`, A função `extract()` em `gzip.js` constrói caminhos de escrita de arquivos usando `fs.createWriteStream(path.join(exportPath, header.name))`. `path.join()` não resolve ou sanitiza segmentos de travessia como `../`. Ele os concatena como estão, significando que uma entrada tar nomeada `../../evil.js` resolve para um caminho fora do diretório de extração pretendido. Nenhum check de caminho canônico é realizado antes de

The Zip Slip vulnerability arises from insufficient path sanitization within the extract() function of gzip.js. Specifically, the code constructs file write paths by concatenating user-supplied filenames (from a tar archive) with the intended export directory. Malicious actors can craft tar entries with filenames containing traversal sequences like ../../, effectively bypassing the intended directory restriction. This allows them to write files to locations outside the export directory, such as overwriting critical system files or injecting malicious code into web-accessible directories. The potential impact is severe, ranging from website defacement and data theft to complete server takeover. This vulnerability shares similarities with other Zip Slip exploits, highlighting the importance of robust path validation when handling user-provided filenames.

ApostropheCMS installations using @apostrophecms/import-export versions prior to 3.5.3 are at risk. This includes developers and system administrators who manage ApostropheCMS deployments, particularly those who allow users to upload files via the import-export functionality. Shared hosting environments running ApostropheCMS are also at increased risk, as a compromised user account could potentially exploit this vulnerability to gain access to the entire server.

• nodejs / server:

find /path/to/node_modules/@apostrophecms/import-export/gzip.js -exec grep -i 'path.join(exportPath, header.name)' {}

• linux / server:

journalctl -f -u node | grep -i "extract()"

• generic web:

curl -I http://your-apostrophe-site.com/import-export/upload.php?file=../../evil.txt

1. 2026-03-18Disclosure

   disclosure

2. 2026-03-18Patch

   patch

1. Reservado2026-03-13
2. Publicada2026-03-18
3. Modificada2026-03-24
4. EPSS atualizado2026-03-26

The primary mitigation for CVE-2026-32731 is to immediately upgrade @apostrophecms/import-export to version 3.5.3 or later. If upgrading is not immediately feasible due to compatibility concerns or breaking changes, consider implementing a temporary workaround by adding strict path validation to the extract() function. This could involve using path.resolve() to canonicalize the file path and ensuring it remains within the intended export directory. Additionally, configure a Web Application Firewall (WAF) to block requests containing suspicious filenames with traversal sequences. Monitor system logs for unusual file creation activity within the export directory. After upgrading, confirm the fix by attempting to import a test archive containing a malicious filename (e.g., ../../evil.txt) and verifying that the file is not written outside the intended directory.