Cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aapostrophecmsapostrophecms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 17:43:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApostropheCMS: Unauthenticated disk exhaustion denial-of-service (CVE-2026-113658)https://feed.craftedsignal.io/briefs/2026-10-apostrophe-dos/Tue, 20 Oct 2026 17:43:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apostrophe-dos/ApostropheCMS versions prior to 4.33.0 contain a vulnerability in the Rich Text CSV conversion route allowing unauthenticated attackers to trigger disk exhaustion through unmanaged temporary file accumulation.ApostropheCMS, an open-source Node.js content management system, contains a vulnerability (CVE-2026-113658) in its Rich Text CSV conversion route. The application fails to properly manage multipart uploads, as it writes incoming files to the system temporary directory before validating file extensions. Critically, the application does not remove these files if the extension validation fails. An unauthenticated attacker can exploit this behavior by repeatedly sending large, specifically crafted, or invalid multipart upload requests while utilizing a valid public CSRF cookie. This process results in the persistent accumulation of files in the temporary directory, which can lead to disk exhaustion. This resource depletion can disrupt the availability of ApostropheCMS and other services residing on the same disk partition. This issue is resolved in version 4.33.0.

Impact

Successful exploitation results in a denial-of-service condition affecting the host system. By filling the temporary storage partition, an attacker can prevent the target server from performing essential file operations, potentially leading to service crashes or total system failure for all applications sharing the storage partition.

Recommendation

  • Update ApostropheCMS to version 4.33.0 or later to ensure proper cleanup of temporary files during failed upload attempts.
  • Monitor system disk space utilization on partitions where the temporary directory (often /tmp or /var/tmp) resides to detect rapid, unauthorized growth indicative of this attack.
  • Restrict access to public-facing CSV import or conversion routes at the web application firewall (WAF) level if immediate patching is not possible.
]]>lowadvisorydenial-of-serviceweb-vulnerability