CVE-2026-113711
Received Received - Intake

Unauthenticated File Upload in ApostropheCMS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: GitHub, Inc.

Description
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113711
EUVD
EUVD-2026-105223

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apostrophecms apostrophe < 4.33.0
@apostrophecms import-export < 3.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated denial-of-service vulnerability in ApostropheCMS's import-export module. It occurs because the chunked import upload process uses bigUploadMiddleware before performing authentication checks. Unauthenticated attackers can initiate uploads, write chunk data to server storage, and trigger temporary file processing, leading to resource exhaustion.

Detection Guidance

Check if your ApostropheCMS version is below 4.33.0 or import-export module is below 3.7.0 by inspecting package.json or running npm list @apostrophecms/import-export. Monitor server logs for unusual upload activity or resource exhaustion patterns during import operations.

Impact Analysis

Attackers can exploit this by sending crafted requests to start, chunk, and end uploads without authentication. This causes server-side storage consumption and filesystem I/O operations, potentially degrading or denying service to the system.

Mitigation Strategies

Upgrade ApostropheCMS to version 4.33.0 or higher and update the import-export module to version 3.7.0 or higher. If immediate upgrade is not possible, restrict network access to import routes or disable chunked uploads temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113711. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart