CVE-2026-113658 in ApostropheCMS
Summary
by MITRE • 10/20/2026
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in ApostropheCMS prior to version 4.33.0 represents a significant resource exhaustion flaw rooted in improper handling of file uploads within the unauthenticated Rich Text CSV conversion route. As an open-source content management system built on Node.js, ApostropheCMS processes various media and data formats for user interaction. The specific technical flaw occurs during the multipart upload process where the system writes the incoming file to a temporary directory before performing any validation checks on the file extension or type. This sequence of operations creates a window of opportunity for attackers to exploit the lack of pre-validation, allowing malicious actors to submit large files that are ultimately rejected due to invalid extensions but have already consumed disk space in the interim.
From an operational perspective, this behavior leads directly to a Denial of Service condition through resource exhaustion. Because the staged file is not removed from the system temporary directory when validation fails, repeated submissions by unauthenticated users can persistently consume available disk capacity on the partition hosting the application's temp files. This accumulation of junk data does not require authentication, as it leverages normal public CSRF cookies to bypass session-based restrictions. Over time, this persistent consumption of temporary-disk space can fill up the drive, causing disruptions not only for ApostropheCMS itself but potentially affecting other services or applications that share the same partition and rely on available disk space for their own operations.
This vulnerability aligns with CWE-403, which describes Exposed File Descriptor to Unintended Control Sphere, specifically in the context of resource management errors where resources are allocated without proper cleanup upon failure conditions. It also maps closely to CWE-770, Allocation of Resources Without Limits or Throttling, as the system fails to limit the amount of disk space that can be consumed by a single user session or IP address during failed upload attempts. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1496, Resource Hijacking, where an attacker consumes resources to degrade service availability for legitimate users. The lack of input validation prior to resource allocation is a classic pattern that leads to such stability issues in web applications handling user-supplied data.
To mitigate this vulnerability and prevent similar occurrences, it is critical to implement strict pre-validation checks before any file system writes occur. Developers should validate the file extension, MIME type, and size against an allowlist prior to initiating the upload process or writing to disk. Additionally implementing rate limiting on unauthenticated endpoints can help curb repeated attempts that lead to resource exhaustion. For existing deployments running versions earlier than 4.33.0, immediate upgrading is required as this issue has been resolved in version 4.33.0 and later releases. System administrators should also monitor temporary directory usage and configure alerts for disk space thresholds to detect potential abuse early. Ensuring that application partitions are isolated from critical system services can further limit the blast radius of such resource exhaustion attacks, protecting other dependent services from disruption caused by a compromised or abused web application component.