{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-113711/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apostrophecms:apostrophe:*:*:*:*:*:*:*:*","cpe:2.3:a:apostrophecms:import-export:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-113711"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@apostrophecms/import-export (\u003c= 3.6.2)","apostrophe (\u003c 4.33.0)"],"_cs_severities":["low"],"_cs_tags":["cve-2026-113711","denial-of-service","web-application"],"_cs_type":"advisory","_cs_vendors":["ApostropheCMS"],"content_html":"\u003cp\u003eApostropheCMS contains a vulnerability in the \u003ccode\u003e@apostrophecms/import-export\u003c/code\u003e package that allows unauthenticated remote attackers to trigger server-side resource consumption. The \u003ccode\u003ebigUploadMiddleware()\u003c/code\u003e is executed before authentication checks are enforced, enabling attackers to initialize chunked uploads, write data to temporary storage, and manipulate cleanup processes via the \u003ccode\u003eaposBigUpload\u003c/code\u003e protocol.\u003c/p\u003e\n\u003cp\u003eThis issue is tracked as CVE-2026-113711. The vulnerability is confirmed in \u003ccode\u003e@apostrophecms/import-export\u003c/code\u003e version 3.6.2 and \u003ccode\u003eapostrophe\u003c/code\u003e prior to version 4.33.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker sends an unauthenticated \u003ccode\u003eaposBigUpload[type]=start\u003c/code\u003e request to the import endpoint.\u003c/li\u003e\n\u003cli\u003eThe server initializes an upload ID and stores attacker-provided metadata, including a declared chunk count, without verifying user session credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker issues \u003ccode\u003eaposBigUpload[type]=chunk\u003c/code\u003e requests to upload arbitrary data to server-side temporary storage.\u003c/li\u003e\n\u003cli\u003eThe attacker sends an \u003ccode\u003eaposBigUpload[type]=end\u003c/code\u003e request to finalize the upload.\u003c/li\u003e\n\u003cli\u003eThe server executes \u003ccode\u003ebigUploadEnd()\u003c/code\u003e and begins processing the stored chunks, creating temporary files.\u003c/li\u003e\n\u003cli\u003eThe application performs a cleanup routine, where the attacker-supplied chunk count influences the number of filesystem deletion operations performed.\u003c/li\u003e\n\u003cli\u003eOnly after the aforementioned I/O operations are completed does the process reach the authentication check in the import handler, where the request is finally rejected.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform unauthorized server-side storage and filesystem I/O. Repeated requests or the use of large chunk count values in the upload metadata can lead to service degradation or denial-of-service via resource exhaustion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eapostrophe\u003c/code\u003e to version 4.33.0 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@apostrophecms/import-export\u003c/code\u003e to version 3.7.0 or later.\u003c/li\u003e\n\u003cli\u003eImplement strict authentication checks before calling \u003ccode\u003ebigUploadMiddleware()\u003c/code\u003e in all import-related routes.\u003c/li\u003e\n\u003cli\u003eEnforce upper bounds on chunk counts and validate declared file sizes against actual data streams to mitigate potential amplification.\u003c/li\u003e\n\u003cli\u003eImplement rate limiting and storage quotas for all upload endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T16:07:02Z","date_published":"2026-10-21T16:07:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apostrophecms-dos/","summary":"ApostropheCMS is vulnerable to an unauthenticated denial-of-service condition due to the order of operations in the import-export middleware, allowing attackers to consume server-side resources.","title":"ApostropheCMS: Unauthenticated resource exhaustion via @apostrophecms/import-export (CVE-2026-113711)","url":"https://feed.craftedsignal.io/briefs/2026-10-apostrophecms-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-113711","version":"https://jsonfeed.org/version/1.1"}