ApostropheCMS Import — Malicious Tar Archive Path Traversal (CVE-2026-32731)

Metadata

Affected Target

Summary

ApostropheCMS supports importing a site/content archive (.tar.gz) containing aposDocs.json and aposAttachments.json metadata files. The import handler does not validate that entries extracted from the archive stay within the intended extraction directory, making it vulnerable to a classic “tar-slip” path traversal. The PoC is a small Python script that builds a minimal valid-looking archive (empty docs/attachments JSON plus one attacker-controlled file) whose file entry path is set to an arbitrary target path (e.g. containing ../ sequences), such that extracting the crafted tarball writes the attacker’s payload outside the intended import directory.

Vulnerability Details

Root Cause

The ApostropheCMS import/extraction routine trusts archive entry paths supplied by the tar/gzip file itself without sanitizing or rejecting path-traversal sequences (../), allowing extracted files to be written outside the intended import directory (a “tar-slip” vulnerability).

Attack Vector

1. Build a crafted .tar.gz archive containing the minimal expected aposDocs.json and aposAttachments.json entries (kept empty/valid) alongside an attacker-controlled payload file.
2. Set the payload’s tar entry name to a path containing directory-traversal sequences (e.g. ../../../var/www/html/shell.php) pointing outside the import root.
3. Submit/upload the crafted archive through ApostropheCMS’s import feature.
4. When the CMS extracts the archive, the traversal path causes the payload to be written to the attacker-chosen location on the server filesystem instead of the intended import directory.

Impact

An attacker able to trigger a site import can write arbitrary files to arbitrary paths on the server filesystem, which can lead to remote code execution (e.g., dropping a web shell) or overwriting sensitive configuration/application files.

Environment / Lab Setup

Target:   ApostropheCMS instance with the import/site-restore feature enabled
Attacker: Python 3 (standard library `tarfile`)

Proof of Concept

PoC Script

See exp.py in this folder.

1

python3 exp.py <payload_file> <target_path>

The script builds evil-slip.tar.gz containing empty aposDocs.json/aposAttachments.json entries plus the given payload file stored under the attacker-chosen target_path (e.g. a path-traversal string); uploading this archive through ApostropheCMS’s import feature causes the payload to be extracted outside the intended directory.

Detection & Indicators of Compromise

Signs of compromise:

• New or modified files outside the expected import/uploads directory correlating with a recent CMS import action.
• Archive uploads containing entry names with directory-traversal sequences in import audit logs.
• Web shell or unexpected executable files appearing in web-served directories.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/0xEr3n/CVE-2026-32731 on 2026-07-05.