ApostropheCMS: Unauthenticated disk exhaustion denial-of-service (CVE-2026-113658)

ApostropheCMS, an open-source Node.js content management system, contains a vulnerability (CVE-2026-113658) in its Rich Text CSV conversion route. The application fails to properly manage multipart uploads, as it writes incoming files to the system temporary directory before validating file extensions. Critically, the application does not remove these files if the extension validation fails. An unauthenticated attacker can exploit this behavior by repeatedly sending large, specifically crafted, or invalid multipart upload requests while utilizing a valid public CSRF cookie. This process results in the persistent accumulation of files in the temporary directory, which can lead to disk exhaustion. This resource depletion can disrupt the availability of ApostropheCMS and other services residing on the same disk partition. This issue is resolved in version 4.33.0.

Impact

Successful exploitation results in a denial-of-service condition affecting the host system. By filling the temporary storage partition, an attacker can prevent the target server from performing essential file operations, potentially leading to service crashes or total system failure for all applications sharing the storage partition.

Recommendation

• Update ApostropheCMS to version 4.33.0 or later to ensure proper cleanup of temporary files during failed upload attempts.
• Monitor system disk space utilization on partitions where the temporary directory (often /tmp or /var/tmp) resides to detect rapid, unauthorized growth indicative of this attack.
• Restrict access to public-facing CSV import or conversion routes at the web application firewall (WAF) level if immediate patching is not possible.