CVE-2026-113658: ApostropheCMS Unauthenticated CSV Import Vulnerability Leading to Disk Space Exhaustion
Summary
CVE-2026-113658: A rejected upload can remain in the operating system temporary directory. Affects apostrophe versions < 4.33.0. Fixed in 4.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is a popular open-source content management system (CMS) built on Node.js that allows users to create and manage websites with ease. It features a rich text editor, customizable widgets, and a flexible content structure. However, a vulnerability has been identified in its CSV import functionality, which can be exploited by unauthenticated users to fill up the server's temporary disk space.
Vulnerability Detail
The vulnerability arises from the way ApostropheCMS handles file uploads through the Multer middleware. When a file is uploaded, it is temporarily stored in the operating system's temporary directory before its extension is validated. If the uploaded file is not a CSV, the system responds with an error, but the temporary file is not deleted. This allows an unauthenticated attacker to repeatedly upload large files, leading to potential disk space exhaustion and causing disruptions to the CMS and other services running on the same server.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.33.0
This is the first release that contains the fix.
npm install apostrophe@4.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a server-side script to regularly clean up the temporary directory, removing files that are older than a certain threshold. For example, you can use a cron job to run a cleanup script that deletes files older than one hour.
Conclusion
The ApostropheCMS vulnerability CVE-2026-113658 poses a significant risk by allowing unauthenticated users to exploit the CSV import functionality, leading to potential disk space exhaustion. It is crucial to update to the patched version to mitigate this risk effectively.
See every vulnerability recorded for apostrophe →
FAQ
The vulnerability allows unauthenticated users to upload files that are not CSVs, leading to the accumulation of temporary files and potential disk space exhaustion.
Any instance of ApostropheCMS that allows unauthenticated users to access the CSV import functionality is at risk.
An attacker could fill the server's temporary disk space, causing the CMS and other services to fail to operate normally.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
