CVE-2026-113658

7.5High

Published 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400, CWE-459, CWE-770

Impact

Unauthenticated remote attackers can exhaust server disk space, crashing ApostropheCMS and co-hosted services via a denial of service. They only need network access to send repeated, large invalid file uploads using standard CSRF tokens.

Root cause

The Rich Text CSV conversion route stages multipart uploads directly to the temporary directory before extension validation and fails to clean up the files when validation rejects them.

Affected systems

ApostropheCMS versions prior to 4.33.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade ApostropheCMS to version 4.33.0 or later. If patching immediately is not possible, block or rate-limit requests to the Rich Text CSV conversion route at your reverse proxy or WAF.

shell

$ npm install apostrophe@^4.33.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113658