CVE-2026-113711 · GHSA-86wm-68pq-5jwq
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
- Risk score
- 69/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ApostropheCMS has a vulnerability that allows unauthenticated requests to perform upload initialization, chunk storage, and temporary processing, leading to resource exhaustion. An attacker could exploit this to exhaust system resources.
- Affected
- {'products': ['ApostropheCMS'], 'packages': [{'ecosystem': 'npm', 'name': 'apostrophe', 'vulnerable': '< 4.33.0', 'patched': '4.33.0'}, {'ecosystem': 'npm', 'name': '@apostrophecms/import-export', 'vulnerable': '< 3.7.0', 'patched': '3.7.0'}]}
- Fix
- Upgrade to version 4.33.0 of ApostropheCMS and version 3.7.0 of the import-export module.
- Exploitation
- Public proof of concept
Story map
At a glance
apostrophe: Amber, patch this week. ApostropheCMS has a vulnerability that allows unauthenticated requests to perform upload initialization, chunk storage, and temporary processing, leading to resource exhaustion. An attacker could exploit this to exhaust system resources.
The flaws
- CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export (CVSS 7.5 · EPSS 1%)
- CVE-2026-113658: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory (CVSS 7.5 · EPSS 1%)
- CVE-2026-113653: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public) (CVSS 6.9 · EPSS 0%)
- CVE-2026-113659: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users (CVSS 6.1 · EPSS 0%)
The fix
Upgrade apostrophe: 4.33.0 or later on your release line
Who is exposed: {'products': ['ApostropheCMS'], 'packages': [{'ecosystem': 'npm', 'name': 'apostrophe', 'vulnerable': '< 4.33.0', 'patched': '4.33.0'}, {'ecosystem': 'npm', 'name': '@apostrophecms/import-export', 'vulnerable': '< 3.7.0', 'patched': '3.7.0'}]}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 256 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| apostrophe | npm | < 4.33.0 | 4.33.0 |
| @apostrophecms/import-export | npm | < 3.7.0 | 3.7.0 |
References
- https://github.com/advisories/GHSA-86wm-68pq-5jwq
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-86wm-68pq-5jwq
- https://nvd.nist.gov/vuln/detail/CVE-2026-113711
- https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
- https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
- https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0
- https://github.com/advisories/GHSA-86wm-68pq-5jwq
Original description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.
Last activity 20 Oct 2026. Patch Forecast updates every hour.