CVE-2026-113711: ApostropheCMS Unauthenticated Resource Exhaustion via Pre-auth AposBigUpload Processing
Summary
CVE-2026-113711: A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. Affects apostrophe versions < 4.33.0. Fixed in 4.33.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ApostropheCMS is an open-source content management system (CMS) designed for building websites and applications with a focus on ease of use and flexibility. The @apostrophecms/import-export package facilitates the import and export of content within the CMS. However, it has a vulnerability that allows unauthenticated users to exploit the chunked import upload functionality, leading to potential denial-of-service attacks.
Vulnerability Detail
A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke self.apos.http.bigUploadMiddleware() before the actual import handler performs its authentication check. Because no authorize callback is supplied to bigUploadMiddleware(), unauthenticated requests can reach the aposBigUpload operations before the later req.user check rejects the import. This allows an unauthenticated attacker to create server-side upload state, write chunk data to upload storage, and trigger cleanup operations before authentication is enforced. The vulnerability can lead to resource exhaustion, repeated filesystem I/O, and potential service degradation.
How To Fix
Latest published version: 4.34.0 as of 23 Oct 2026
npm install apostrophe@4.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.33.0
This is the first release that contains the fix.
npm install apostrophe@4.33.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement an authorization check before invoking the bigUploadMiddleware() in your import routes. For example:
importExportImport: [
(req, res, next) => {
if (!req.user) {
return res.status(403).send('Forbidden');
}
next();
},
self.apos.http.bigUploadMiddleware(),
async (req) => {
return self.apos.modules['@apostrophecms/import-export']
.import(req, self.__meta.name);
}
]
Conclusion
The CVE-2026-113711 vulnerability in the @apostrophecms/import-export package poses a significant risk by allowing unauthenticated users to exploit the chunked import upload functionality. It is crucial to update to the patched version and implement proper authentication checks to mitigate this risk.
See every vulnerability recorded for apostrophe →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The confirmed affected version is 3.6.2, and earlier 3.x releases may also be affected.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
The vulnerability can lead to consumption of upload and temporary storage, creation of server-side upload state by unauthenticated users, repeated filesystem I/O, and potential service degradation or denial of service.
If you cannot update the package immediately, implement the suggested workaround to enforce authentication before processing any upload operations.
References
Related vulnerabilities
Recent vulnerabilities recorded for apostrophe.
