This issue is tracked as CVE-2026-113711. The vulnerability is confirmed in @apostrophecms/import-export version 3.6.2 and apostrophe prior to version 4.33.0.

Attack Chain

1. An attacker sends an unauthenticated aposBigUpload[type]=start request to the import endpoint.
2. The server initializes an upload ID and stores attacker-provided metadata, including a declared chunk count, without verifying user session credentials.
3. The attacker issues aposBigUpload[type]=chunk requests to upload arbitrary data to server-side temporary storage.
4. The attacker sends an aposBigUpload[type]=end request to finalize the upload.
5. The server executes bigUploadEnd() and begins processing the stored chunks, creating temporary files.
6. The application performs a cleanup routine, where the attacker-supplied chunk count influences the number of filesystem deletion operations performed.
7. Only after the aforementioned I/O operations are completed does the process reach the authentication check in the import handler, where the request is finally rejected.

Impact

Successful exploitation allows unauthenticated attackers to perform unauthorized server-side storage and filesystem I/O. Repeated requests or the use of large chunk count values in the upload metadata can lead to service degradation or denial-of-service via resource exhaustion.

Recommendation

• Upgrade apostrophe to version 4.33.0 or later.
• Upgrade @apostrophecms/import-export to version 3.7.0 or later.
• Implement strict authentication checks before calling bigUploadMiddleware() in all import-related routes.
• Enforce upper bounds on chunk counts and validate declared file sizes against actual data streams to mitigate potential amplification.
• Implement rate limiting and storage quotas for all upload endpoints.