{"action":"Upgrade @apostrophecms/import-export to 3.5.3 or later.","affected":[{"fixed":"3.5.3","introduced":"0"}],"component":"@apostrophecms/import-export","cve_ids":["CVE-2026-32731"],"ecosystem":"npm","epss":0.0055,"exploited":false,"fixed_versions":["3.5.3"],"ghsa_id":"GHSA-mwxc-m426-3f78","id":"tcs_01M5KG1ZTAHRD5CRKZVYGBQJP6","modified_at":"2026-03-18T20:11:21.607708Z","published_at":"2026-03-18T19:49:07Z","references":["https://osv.dev/vulnerability/GHSA-mwxc-m426-3f78","https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-mwxc-m426-3f78","https://github.com/apostrophecms/apostrophe"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-mwxc-m426-3f78","url":"https://osv.dev/vulnerability/GHSA-mwxc-m426-3f78"}],"summary":"ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction"}