CVE-2026-113656

Deferred Deferred - Pending Action

Denial of Service in ApostropheCMS Form via Unbounded Uploads

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113656

EUVD

EUVD-2026-105185

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.33.0
@apostrophecms	form	< 1.5.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

ApostropheCMS Form versions before 1.5.5 allow unauthenticated attackers to upload large files without size, count, or rate limits. The system processes these uploads to the server's temporary directory before validation or authentication, consuming disk space and disrupting services.

Detection Guidance

Monitor disk usage in the system's temporary directory where uploads are staged. Check for unusually high disk consumption or rapid file growth in directories like /tmp or /var/tmp. Use commands like 'df -h' to track disk space and 'lsof +D /tmp' to identify processes writing large files.

Impact Analysis

Attackers can fill up server storage with large files, causing disk exhaustion and potential system crashes. This may lead to denial-of-service conditions, disrupting form handling and other services on the host.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by consuming disk storage and saturating system resources, which may impact availability of services handling personal or sensitive data. For GDPR, this could affect the integrity and availability of data processing systems. For HIPAA, it may disrupt systems storing protected health information by causing downtime or data loss.

Mitigation Strategies

Upgrade the @apostrophecms/form package to version 1.5.5 or later. Implement server-side size limits for file uploads, enforce authentication before processing uploads, and add rate limiting to the form submission endpoint. Ensure proper cleanup of temporary files after processing.

Hi! I’m here to help you understand CVE-2026-113656. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...