{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apostrophecms--4.33.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-113658"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ApostropheCMS (\u003c 4.33.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["ApostropheCMS"],"content_html":"\u003cp\u003eApostropheCMS, an open-source Node.js content management system, contains a vulnerability (CVE-2026-113658) in its Rich Text CSV conversion route. The application fails to properly manage multipart uploads, as it writes incoming files to the system temporary directory before validating file extensions. Critically, the application does not remove these files if the extension validation fails. An unauthenticated attacker can exploit this behavior by repeatedly sending large, specifically crafted, or invalid multipart upload requests while utilizing a valid public CSRF cookie. This process results in the persistent accumulation of files in the temporary directory, which can lead to disk exhaustion. This resource depletion can disrupt the availability of ApostropheCMS and other services residing on the same disk partition. This issue is resolved in version 4.33.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial-of-service condition affecting the host system. By filling the temporary storage partition, an attacker can prevent the target server from performing essential file operations, potentially leading to service crashes or total system failure for all applications sharing the storage partition.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate ApostropheCMS to version 4.33.0 or later to ensure proper cleanup of temporary files during failed upload attempts.\u003c/li\u003e\n\u003cli\u003eMonitor system disk space utilization on partitions where the temporary directory (often /tmp or /var/tmp) resides to detect rapid, unauthorized growth indicative of this attack.\u003c/li\u003e\n\u003cli\u003eRestrict access to public-facing CSV import or conversion routes at the web application firewall (WAF) level if immediate patching is not possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T17:43:43Z","date_published":"2026-10-20T17:43:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apostrophe-dos/","summary":"ApostropheCMS versions prior to 4.33.0 contain a vulnerability in the Rich Text CSV conversion route allowing unauthenticated attackers to trigger disk exhaustion through unmanaged temporary file accumulation.","title":"ApostropheCMS: Unauthenticated disk exhaustion denial-of-service (CVE-2026-113658)","url":"https://feed.craftedsignal.io/briefs/2026-10-apostrophe-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - ApostropheCMS (\u003c 4.33.0)","version":"https://jsonfeed.org/version/1.1"}