Security fix · CVE-2026-113658
ApostropheCMS is an open-source Node.js content management system.
Published Oct 20, 2026 · catalog updated Oct 23, 2026 · ApostropheCMS is an open-source
Last checked Nov 3, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-113658. EPSS is 0.61%. Act only if a listed version of ApostropheCMS is an open-source is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (ApostropheCMS is an open-source).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High7.5
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.61%
- Remediation
- Advisory link
- Affected products
- npm apostrophe
### Summary A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space. ### Details The endpoint is: In , Multer first writes the upload to . The handler then rejects filenames whose extension is not , but there is no cleanup of the Multer file on this error path. The route does not require an authenticated user. A normal CSRF cookie is sufficient. During testing, the request returned HTTP 400 with , while the complete uploaded content remained in a randomly named file in the configured temporary directory after the response. ### Relationship to prior public work I reviewed [PR #5013](https://github.com/apostrophecms/apostrophe/pull/5013), which migrated the Rich Text CSV upload path from to Multer. This report concerns cleanup after that migration: the rejected Multer file remains on disk, a behavior not described in the PR or its review discussion. ### POC Create a small test file. A larger file can be used to demonstrate disk growth, but 1 MiB is enough for a safe local reproduction: Obtain the normal site cookies and send the rejected upload: The response is HTTP 400. Compare the contents of the system temporary directory before and after the request: A new randomly named file remains present and contains the uploaded bytes. No login is required. Repeating the multipart request creates additional persistent temporary files. ### Impact A remote unauthenticated attacker can fill the partition used by the operating system temporary directory. Once that partition is exhausted, Apostrophe and unrelated services on the same host may fail to upload files, create temporary data, or continue operating normally. The attack requires only repeated HTTP requests and the stored files remain after each rejected response.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- npm apostrophe0 → 4.33.0
How to fix CVE-2026-113658
Upgrade
CVE-2026-113658 lists a fix boundary at 4.33.0. Compare the installed build with that boundary before you change production.
Version check
Fixed in 4.33.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-113658. EPSS is 0.61%. Act only if a listed version of ApostropheCMS is an open-source is installed.
Which versions are affected?
Compare what you have installed with 0 → 4.33.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-400: Uncontrolled Resource Consumption; CWE-459; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.61%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 20, 2026 · NIST NVD
Detected
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-d
Oct 20, 2026 · GitHub Advisory Database
Fix available
apostrophe fixed in 4.33.0
Oct 20, 2026 · GitHub Advisory Database
Fix available
apostrophe fixed in 4.33.0
Oct 20, 2026 · GitHub Advisory Database
Updated
### Summary A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space. ### Details The endpoint is: In , Multer first writes the upload to . The handler then reject
Oct 20, 2026 · NIST NVD
Updated
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-d
Oct 23, 2026 · NIST NVD
Updated
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-d
Sources
- CVE.orgVulnerability recordCVE-2026-113658
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-113658
30-day exploitation probability 0.61%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-qhcq-9pm2-c9w9
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDVulnerability recordCVE-2026-113658
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validatio
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-qhcq-9pm2-c9w9
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
osv.dev
References
Freshness
Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 3, 2026
- NIST NVDOct 23, 2026
- CVE.orgOct 21, 2026
- GitHub Advisory DatabaseOct 20, 2026
- OpenSSF OSV / OSV ScannerOct 20, 2026