CVE-2026-113658
HIGH
7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.
400
Uncontrolled Resource Consumption
DraftCommon Consequences
Security Scopes Affected:
Availability
Access Control
Other
Potential Impacts:
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Bypass Protection Mechanism
Other
Applicable Platforms
Technologies:
Not Technology-Specific, AI/ML
459
Incomplete Cleanup
DraftCommon Consequences
Security Scopes Affected:
Other
Confidentiality
Integrity
Potential Impacts:
Other
Read Application Data
Modify Application Data
Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
770
Allocation of Resources Without Limits or Throttling
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c2…
https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25…
https://github.com/apostrophecms/apostrophe/releases/tag/[email protected]
https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-qhcq-9pm2-…