Patch Forecast
Amber warning
Patch this week.

CVE-2026-113658 · GHSA-qhcq-9pm2-c9w9

ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

Risk score
64/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.5%
Published
20 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected u…
Affected
apostrophe (npm) < 4.33.0
Fix
Upgrade apostrophe to 4.33.0 or later.
Exploitation
No known exploitation

Story map

Story map: apostropheTHE FLAWSTHE FIXCVE-2026-113658ApostropheCMS:Unauthenticated CSV importrequests leave rejected…CVSS 7.5 · EPSS 1%CVE-2026-113711ApostropheCMS:Unauthenticated resourceexhaustion via pre-auth…CVSS 7.5 · EPSS 1%CVE-2026-113653ApostropheCMS: The generalpublic can access@apostrophecms/user…CVSS 6.9 · EPSS 0%CVE-2026-113659ApostropheCMS: Client-sidePrototype Pollution inapos.http.parseQuery leading…CVSS 6.1 · EPSS 0%Upgrade apostrophe4.33.0or later on your release lineWho is exposed{'products': ['ApostropheCMS'],'packages': [{'ecosystem':'npm', 'name': 'apostrophe','vulnerable': '< 4.33.0','patched': '4.33.0'}…AMBER · PATCH THIS WEEKapostropheApostropheCMS has avulnerability that allowsunauthenticated requests toperform upload initialization,chunk storage, and temporaryprocessing, leading to resourceexhaustion. An attacker could…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-400)254 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

apostrophe: Amber, patch this week. ApostropheCMS has a vulnerability that allows unauthenticated requests to perform upload initialization, chunk storage, and temporary processing, leading to resource exhaustion. An attacker could exploit this to exhaust system resources.

The flaws

  • CVE-2026-113658: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5 · EPSS 1%)
  • CVE-2026-113653: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (CVSS 6.9 · EPSS 0%)
  • CVE-2026-113659: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users (CVSS 6.1 · EPSS 0%)

The fix

Upgrade apostrophe: 4.33.0 or later on your release line

Who is exposed: {'products': ['ApostropheCMS'], 'packages': [{'ecosystem': 'npm', 'name': 'apostrophe', 'vulnerable': '< 4.33.0', 'patched': '4.33.0'}, {'ecosystem': 'npm', 'name': '@apostrophecms/import-export', 'vulnerable': '< 3.7.0', 'patched': '3.7.0'}]}

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
apostrophenpm< 4.33.04.33.0

References

Original description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.

Last activity 20 Oct 2026. Patch Forecast updates every hour.