CVE-2026-113664: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the resulting fs.WriteStream opens a directory and emits EISDIR with no error listener attached, which terminates the Node process.
Confirmed on default-branch HEAD 1bd5d0a7a6fe880836fa75adad6964f1c577d640, package version 3.6.2.
References
- github.com/advisories/GHSA-97wv-p4xx-c7mg
- github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.0
- github.com/apostrophecms/apostrophe/security/advisories/GHSA-97wv-p4xx-c7mg
- nvd.nist.gov/vuln/detail/CVE-2026-113664
Code Behaviors & Features
Detect and mitigate CVE-2026-113664 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →