CVE-2026-32731 - Vulnerability Analysis

Overview

ApostropheCMS @apostrophecms/import-export < 3.5.3 contains a path traversal caused by unsanitized file paths in extract() function in gzip.js, letting users with Global Content Modify permission write files outside intended directories.

Severity & Score

Impact

Attackers with Global Content Modify permission can write arbitrary files anywhere on the host filesystem accessible to the Node.js process.

Mitigation

Upgrade to version 3.5.3 or later.

References

• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mwxc-m426-3f78

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner