CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ApostropheCMSto a version that resolves this vulnerability.Fixed in 4.33.0 - Upgrade
Upgrade
@apostrophecms/import-exportto a version that resolves this vulnerability.Fixed in 3.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote requester can trigger the affected import routes. No credentials or user interaction are required.
What resources can an attacker consume before authorization is rejected?
Requests can cause upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work to occur before the later user check rejects the import.
Which versions contain the fix?
The issue is fixed in ApostropheCMS 4.33.0 and in version 3.7.0 of @apostrophecms/import-export.