CVE-2026-113658

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-20

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-23

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113658

EUVD

EUVD-2026-105188

Affected Vendors & Products

Vendor	Product	Version / Range
apostrophecms	apostrophe	< 4.33.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

ApostropheCMS versions before 4.33.0 have a flaw in the unauthenticated Rich Text CSV conversion route. When processing CSV uploads, the system writes files to the temporary directory before validating file extensions. If the extension is invalid, the file is not removed, leading to persistent disk space consumption. Repeated large uploads can exhaust temporary storage, disrupting ApostropheCMS and other services sharing the same partition.

Detection Guidance

Monitor the system's temporary directory for unusually large or numerous files. Check for files left by the ApostropheCMS CSV conversion route, particularly in the default temporary directory (e.g., /tmp or /var/tmp). Use commands like 'ls -lh /tmp' or 'find /tmp -type f -size +10M' to identify large files. Also, inspect Apache or Nginx access logs for repeated POST requests to /api/v1/@apostrophecms/rich-text-widget/generate-csv-table.

Check disk usage on the partition hosting the temporary directory with 'df -h' or 'du -sh /tmp'. If usage is unexpectedly high, investigate further for malicious upload attempts.

Impact Analysis

This vulnerability can cause persistent disk space exhaustion by leaving rejected CSV uploads in the temporary directory. This may lead to system-wide failures, including downtime for ApostropheCMS and other services relying on the same storage partition. Attackers can exploit this without authentication beyond a normal CSRF cookie.

Compliance Impact

This vulnerability primarily impacts system availability by consuming temporary disk space through unauthenticated CSV uploads. While it does not directly expose or leak data, it could indirectly affect compliance by disrupting services that handle sensitive data under GDPR or HIPAA, potentially leading to downtime or service unavailability for systems relying on the same partition.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or later immediately to patch the vulnerability. If upgrading is not immediately possible, restrict access to the vulnerable endpoint by implementing firewall rules or web application firewall (WAF) policies to block POST requests to /api/v1/@apostrophecms/rich-text-widget/generate-csv-table.

Temporarily increase monitoring of disk usage on the temporary directory partition. Implement automated cleanup scripts to remove old or large temporary files regularly until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-113658. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...