ApostropheCMS's @apostrophecms/import-export module (versions before 3.6.2) contains a path traversal vulnerability that allows authenticated contributors to read arbitrary files on the host system. This occurs because the module constructs file paths from unvalidated JSON metadata fields in an imported archive, enabling traversal outside the intended directory. Files with certain allowed extensions (e.g., txt, csv, pdf) can be read and then served publicly without authentication. The vulnerability requires contributor-level access and is fixed in version 3.6.2.