https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 06:34:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113664 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113664 https://db.gcve.eu/vuln/ghsa-97wv-p4xx-c7mg <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>### Summary</p> <p>The tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.</p> <p>Confirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.</p> <p>### Details</p> <p>`packages/import-export/lib/formats/gzip.js`, in the tar-stream `entry` handler inside `extract(filepath, exportPath)`:</p> <p>```js const name = header.name.replace(/\\/g, &#39;/&#39;); if (name.includes(&#39;../&#39;)) { // skipped } ... stream.pipe(fs.WriteStream(path.join(exportPath, name))); ```</p> <p>Two separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no `error` handler, so any stream error becomes an unhandled `&#39;error&#39;` event.</p> <p>Reaching it needs an account that can import, nothing more. `packages/import-export/modules/@apostrophecms/import-export-page/index.js` exposes `post.importExportImport`, which calls into `lib/methods/import.js`; that handler requires `req.user` and then calls `format.input(exportPath)`, which for a `.gz` upload is `gzip.js` calling `extract()` on the uploaded archive.</p> <p>### PoC</p> <p>This is n…</p> <p><strong>Affected:</strong> npm: @apostrophecms/import-export</p> <p>### Summary</p> <p>The tar-extraction guard added to `@apostrophecms/import-export` for GHSA-mwxc-m426-3f78 is a literal substring test for `../`, and `./..` does not contain that substring. An entry named `./..` therefore passes the guard, `path.join` normalizes it to the parent of the export directory, and the resulting `fs.WriteStream` opens a directory and emits `EISDIR` with no `error` listener attached, which terminates the Node process.</p> <p>Confirmed on default-branch HEAD `1bd5d0a7a6fe880836fa75adad6964f1c577d640`, package version `3.6.2`.</p> <p>### Details</p> <p>`packages/import-export/lib/formats/gzip.js`, in the tar-stream `entry` handler inside `extract(filepath, exportPath)`:</p> <p>```js const name = header.name.replace(/\\/g, &#39;/&#39;); if (name.includes(&#39;../&#39;)) { // skipped } ... stream.pipe(fs.WriteStream(path.join(exportPath, name))); ```</p> <p>Two separate problems sit in those four lines. The guard tests the raw entry name for a substring instead of resolving the joined path and requiring containment, and the write stream has no `error` handler, so any stream error becomes an unhandled `&#39;error&#39;` event.</p> <p>Reaching it needs an account that can import, nothing more. `packages/import-export/modules/@apostrophecms/import-export-page/index.js` exposes `post.importExportImport`, which calls into `lib/methods/import.js`; that handler requires `req.user` and then calls `format.input(exportPath)`, which for a `.gz` upload is `gzip.js` calling `extract()` on the uploaded archive.</p> <p>### PoC</p> <p>This is n…</p> https://db.gcve.eu/vuln/ghsa-97wv-p4xx-c7mg