CVE-2026-63667 apostrophecms CVE debrief

Who should care

ApostropheCMS users with contributor roles or deployments using the import-export module should assess exposure and verify inventory for potential vulnerability. This includes reviewing system configurations, checking for updates, and ensuring that contributor roles are properly restricted to limit access to sensitive features.

Why it matters

CVE-2026-63667 allows authenticated contributors to read and publish files due to improper path handling in the ApostropheCMS import-export module. Defenders should assess exposure, verify inventory, and consider upgrading to version 3.6.2.

• Authenticated contributors can read host files with allowed extensions
• Files can be published at unauthenticated uploads URLs
• Verify inventory and upgrade to 3.6.2 if possible
• Restrict contributor roles to limit access to sensitive features

Technical summary

The ApostropheCMS import-export module constructs an attachment source path from attacker-controlled fields without ensuring the resolved path remains under the extracted attachments directory. This allows an authenticated contributor to import a crafted archive, read a host file with an allowed extension, and publish the copied file at an unauthenticated uploads URL. The issue is fixed in version 3.6.2, which corrects the flawed path handling. Users with contributor roles or deployments using the import-export module should assess exposure and verify inventory for potential vulnerability.

Defensive priority

Assess exposure: ApostropheCMS users with contributor roles; verify inventory and upgrade to 3.6.2 if possible.

Recommended defensive actions

• Assess exposure: review ApostropheCMS deployments for contributor roles and upgrade to version 3.6.2 if possible
• Verify inventory: check for instances of ApostropheCMS with import-export module usage
• Restrict contributor roles: limit access to sensitive features and monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

CVE and NVD records provide details on the vulnerability and fix in ApostropheCMS version 3.6.2. The import-export module's flawed path handling allows authenticated contributors to read host files with allowed extensions. The issue is addressed in version 3.6.2, which corrects the path handling to prevent unauthorized file access and publication. Defenders should verify inventory and consider upgrading to the patched version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.