CVE-2026-32731 - Vulnerability Analysis

Overview

ApostropheCMS @apostrophecms/import-export < 3.5.3 contains a path traversal caused by unsanitized file paths in extract() function in gzip.js, letting users with Global Content Modify permission write files outside intended directories.

Severity & Score

Impact

Attackers with Global Content Modify permission can write arbitrary files anywhere on the host filesystem accessible to the Node.js process.

Mitigation

Upgrade to version 3.5.3 or later.

References

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mwxc-m426-3f78

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 19, 2026

🔎 CVE-2026-32731 (CRITICAL, CVSS 10): Path traversal in ApostropheCMS import-export <3.5.3 lets attackers write files as Node.js user via crafted archives. Upgrade to 3.5.3+ and restrict permissions now! Details: https://radar.offseq.com/threat/cve-2026-32731-cwe-22-improper-limitation-of-a-pat-efa014e1 #OffSeq #CVE202632731 #infosec #cms

View original post

GitHub Repositories(1 repo)

• https://github.com/0xEr3n/CVE-2026-32731

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner