CVE-2026-113656: ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMS Form add-onto a version that resolves this vulnerability.Fixed in 1.5.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances using ApostropheCMS Form versions before 1.5.5 are affected if their form submission route is reachable by unauthenticated users. The route accepts multipart uploads before authentication or form validation.
What does an attacker need to exploit it?
An attacker only needs network access to submit repeated multipart form requests. No credentials or user interaction are required.
Are default safeguards sufficient to limit the impact?
No upload size, upload count, or request rate limits are present on the affected form submission route. Repeated submissions can consume temporary disk storage and disrupt form handling or other services on the host.
What should be done if patching cannot happen immediately?
The provided data identifies the missing controls as upload size, upload count, and request rate limits, but does not specify a documented workaround. Prioritize restricting unauthenticated access to the affected form submission route where feasible and monitor temporary disk consumption.
How can I determine whether remediation is needed?
Check whether the deployment uses the ApostropheCMS Form add-on and whether its version is earlier than 1.5.5. Version 1.5.5 contains the fix.