CVE-2026-113664

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

Summary

The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the resulting fs.WriteStream opens a directory and emits EISDIR with no error listener attached, which terminates the Node process.

Confirmed on default-branch HEAD 1bd5d0a7a6fe880836fa75adad6964f1c577d640, package version 3.6.2.

Details

packages/import-export/lib/formats/gzip.js, in the tar-stream entry handler inside extract(filepath, exportPath):

const name = header.name.replace(/\\/g, '/');
if (name.includes('../')) {
  // skipped
}
...
stream.pipe(fs.WriteStream(path.join(exportPath, name)));

Two separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no error handler, so any stream error becomes an unhandled 'error' event.

Reaching it needs an account that can import, nothing more. packages/import-export/modules/@apostrophecms/import-export-page/index.js exposes post.importExportImport, which calls into lib/methods/import.js; that handler requires req.user and then calls format.input(exportPath), which for a .gz upload is gzip.js calling extract() on the uploaded archive.

PoC

This is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from post.importExportImport to extract() was read, not observed.

The guard misses the payload:

node -e "console.log('./..'.includes('../')); console.log('..'.includes('../')); console.log('a/./..'.includes('../'));"

false
false
false

path.join then resolves it out of the export directory:

node -e "const path=require('path'); const exportPath='/tmp/exportRoot'; console.log(path.join(exportPath,'./..'));"

/tmp

And a write stream opened on a directory, with no error listener, kills the process rather than failing the request:

node -e "const fs=require('fs'); const s=fs.createWriteStream('/tmp'); s.write('x'); s.end(); setTimeout(()=>console.log('still alive'),500);"

events.js:291
      throw er; // Unhandled 'error' event
      ^

Error: EISDIR: illegal operation on a directory, open '/tmp'
Emitted 'error' event on WriteStream instance at:
    at internal/fs/streams.js:361:12
    at FSReqCallback.oncomplete (fs.js:156:23) {
  errno: -21,
  code: 'EISDIR',
  syscall: 'open',
  path: '/tmp'
}

The events.js:291 frame shows that transcript came off the Node 14 line my audit box had. The unhandled-error-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run.

Source-side confirmation without running anything:

grep -n "includes('../')" packages/import-export/lib/formats/gzip.js
grep -n "WriteStream" packages/import-export/lib/formats/gzip.js

Impact

An authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way.

Suggested fix

Resolve the target and require containment, and attach an error handler:

const base = path.resolve(exportPath);
const target = path.resolve(path.join(exportPath, name));

if (target !== base && !target.startsWith(base + path.sep)) {
  stream.on('end', next);
  stream.resume();
  return;
}

if (header.type === 'directory') {
  fsp.mkdir(target).then(next).catch(reject);
} else {
  const out = fs.WriteStream(target);
  out.on('error', reject);
  stream.pipe(out);
  stream.on('end', next);
}

The error handler earns its place independently. Any tar entry that lands on an existing…

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

Summary

The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the resulting fs.WriteStream opens a directory and emits EISDIR with no error listener attached, which terminates the Node process.

Confirmed on default-branch HEAD 1bd5d0a7a6fe880836fa75adad6964f1c577d640, package version 3.6.2.

Details

packages/import-export/lib/formats/gzip.js, in the tar-stream entry handler inside extract(filepath, exportPath):

const name = header.name.replace(/\\/g, '/');
if (name.includes('../')) {
  // skipped
}
...
stream.pipe(fs.WriteStream(path.join(exportPath, name)));

Two separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no error handler, so any stream error becomes an unhandled 'error' event.

Reaching it needs an account that can import, nothing more. packages/import-export/modules/@apostrophecms/import-export-page/index.js exposes post.importExportImport, which calls into lib/methods/import.js; that handler requires req.user and then calls format.input(exportPath), which for a .gz upload is gzip.js calling extract() on the uploaded archive.

PoC

This is not an end-to-end exploit. What follows is each of the three primitives the crash depends on, executed individually, plus a source-level trace of the route. The chain from post.importExportImport to extract() was read, not observed.

The guard misses the payload:

node -e "console.log('./..'.includes('../')); console.log('..'.includes('../')); console.log('a/./..'.includes('../'));"

false
false
false

path.join then resolves it out of the export directory:

node -e "const path=require('path'); const exportPath='/tmp/exportRoot'; console.log(path.join(exportPath,'./..'));"

/tmp

And a write stream opened on a directory, with no error listener, kills the process rather than failing the request:

node -e "const fs=require('fs'); const s=fs.createWriteStream('/tmp'); s.write('x'); s.end(); setTimeout(()=>console.log('still alive'),500);"

events.js:291
      throw er; // Unhandled 'error' event
      ^

Error: EISDIR: illegal operation on a directory, open '/tmp'
Emitted 'error' event on WriteStream instance at:
    at internal/fs/streams.js:361:12
    at FSReqCallback.oncomplete (fs.js:156:23) {
  errno: -21,
  code: 'EISDIR',
  syscall: 'open',
  path: '/tmp'
}

The events.js:291 frame shows that transcript came off the Node 14 line my audit box had. The unhandled-error-event behavior is not version specific, but the exact message on your supported Node versions is worth a re-run.

Source-side confirmation without running anything:

grep -n "includes('../')" packages/import-export/lib/formats/gzip.js
grep -n "WriteStream" packages/import-export/lib/formats/gzip.js

Impact

An authenticated user who can reach the import UI uploads one crafted archive and takes down the Node process handling it. Every worker that picks up such an archive dies the same way.

Suggested fix

Resolve the target and require containment, and attach an error handler:

const base = path.resolve(exportPath);
const target = path.resolve(path.join(exportPath, name));

if (target !== base && !target.startsWith(base + path.sep)) {
  stream.on('end', next);
  stream.resume();
  return;
}

if (header.type === 'directory') {
  fsp.mkdir(target).then(next).catch(reject);
} else {
  const out = fs.WriteStream(target);
  out.on('error', reject);
  stream.pipe(out);
  stream.on('end', next);
}

The error handler earns its place independently. Any tar entry that lands on an existing…