Skip to content
OpenAdvisories

Vendor

apostrophecms

56 known vulnerabilities.

Products

apostrophe 50 import-export 8 sanitize-html 7 uploadfs 2 form 2 db-connect 1 ai-helper 1 passport-bridge 1 login-hcaptcha 1 login-recaptcha 1 @apostrophecms/seo 1 @apostrophecms/cli 1 ApostropheCMS 1 mport-export 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 10.0
    CVE-2026-32731 Public exploit

    ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction

    ApostropheCMS is an open-source content management framework. Prior to version 3.5.3 of `@apostrophecms/import-export`, The `extract()` function in `gzip.js` constructs file-write paths using `fs.createWriteStream(path.join(exportPath, header.name))`. `path.j…

    apostrophecms import-export @apostrophecms/import-export npm