What’s Vulnerable › Vulnerabilities

CVE-2026-113656: ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-21
• Weakness: CWE-770

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.

Affected products

• apostrophecms apostrophe: before 4.33.0
• @apostrophecms form: before 1.5.5

References

• https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce
• https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350
• https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5
• https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-89mh-mm8c-mv7f

Get alerted when CVE-2026-113656 or the next vulnerability affects your stack