CVE-2026-113664: ApostropheCMS Import-Export Package Vulnerability Leading to Node Process Termination
Summary
CVE-2026-113664: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test. Affects @apostrophecms/import-export versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications. It offers features such as in-context editing, a modular architecture, and a user-friendly interface. The '@apostrophecms/import-export' package allows users to import and export content, but it has a vulnerability that can lead to a denial of service when handling crafted tar archives.
Vulnerability Detail
The vulnerability arises from a flaw in the tar-extraction guard within the '@apostrophecms/import-export' package. The guard performs a literal substring test for '..', which allows entries named './..' to bypass the check. This results in the 'path.join' function normalizing the path to the parent directory of the export directory. Consequently, when a write stream attempts to open a directory, it emits an 'EISDIR' error without an attached error listener, causing the Node process to terminate unexpectedly. This vulnerability can be exploited by an authenticated user who can access the import functionality, leading to a denial of service for the application.
How To Fix
Latest published version: 3.7.1 as of 22 Oct 2026
npm install @apostrophecms/import-export@3.7.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.0
This is the first release that contains the fix.
npm install @apostrophecms/import-export@3.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the contents of the tar archive before importing it, ensuring that it does not contain any entries that could exploit this vulnerability. However, this is not a long-term solution and updating the package is recommended.
Conclusion
In summary, CVE-2026-113664 is a significant vulnerability in the '@apostrophecms/import-export' package that can lead to Node process termination. It is crucial to update to the patched version to mitigate the risk and ensure the stability of your application.
See every vulnerability recorded for @apostrophecms/import-export →
FAQ
CVE-2026-113664 is a vulnerability in the '@apostrophecms/import-export' package that can lead to the termination of the Node process when a crafted tar archive is imported.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to test your application.
The main consequence is a denial of service, where the Node process handling the import will crash, affecting the availability of the application.
You can update the package by running the command: npm install @apostrophecms/import-export@3.7.0 in your project directory.
While the vulnerability primarily leads to a denial of service, it does not directly cause data loss. However, if the application is down, users may not be able to access or manage content.
References
Related vulnerabilities
Recent vulnerabilities recorded for @apostrophecms/import-export.
