CVE-2026-113711

7.5High

Published 20 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-400, CWE-770

Impact

Unauthenticated remote attackers can exhaust server disk space and processing resources to cause a denial of service. They only need network access to send unauthenticated requests to import routes.

Root cause

Import routes call upload middleware without an early authorization callback, processing and storing file chunks before verifying user permissions.

Affected systems

ApostropheCMS prior to 4.33.0 and @apostrophecms/import-export module prior to 3.7.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade ApostropheCMS to version 4.33.0 or higher and @apostrophecms/import-export to version 3.7.0 or higher. No interim configuration mitigation is provided in the advisory.

shell

$ npm install apostrophe@^4.33.0 @apostrophecms/import-export@^3.7.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113711