ApostropheCMS: Unauthenticated resource exhaustion via @apostrophecms/import-export (CVE-2026-113711)

ApostropheCMS contains a vulnerability in the @apostrophecms/import-export package that allows unauthenticated remote attackers to trigger server-side resource consumption. The bigUploadMiddleware() is executed before authentication checks are enforced, enabling attackers to initialize chunked uploads, write data to temporary storage, and manipulate cleanup processes via the aposBigUpload protocol.

This issue is tracked as CVE-2026-113711. The vulnerability is confirmed in @apostrophecms/import-export version 3.6.2 and apostrophe prior to version 4.33.0.

Attack Chain

1. An attacker sends an unauthenticated aposBigUpload[type]=start request to the import endpoint.
2. The server initializes an upload ID and stores attacker-provided metadata, including a declared chunk count, without verifying user session credentials.
3. The attacker issues aposBigUpload[type]=chunk requests to upload arbitrary data to server-side temporary storage.
4. The attacker sends an aposBigUpload[type]=end request to finalize the upload.
5. The server executes bigUploadEnd() and begins processing the stored chunks, creating temporary files.
6. The application performs a cleanup routine, where the attacker-supplied chunk count influences the number of filesystem deletion operations performed.
7. Only after the aforementioned I/O operations are completed does the process reach the authentication check in the import handler, where the request is finally rejected.

Impact

Successful exploitation allows unauthenticated attackers to perform unauthorized server-side storage and filesystem I/O. Repeated requests or the use of large chunk count values in the upload metadata can lead to service degradation or denial-of-service via resource exhaustion.

Recommendation

• Upgrade apostrophe to version 4.33.0 or later.
• Upgrade @apostrophecms/import-export to version 3.7.0 or later.
• Implement strict authentication checks before calling bigUploadMiddleware() in all import-related routes.
• Enforce upper bounds on chunk counts and validate declared file sizes against actual data streams to mitigate potential amplification.
• Implement rate limiting and storage quotas for all upload endpoints.