CVE-2026-113711: apostrophecms apostrophe Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-113711 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in apostrophecms apostrophe. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.7% of scored vulnerabilities.

Timeline

1. 20-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.