Unbounded Multipart Upload Vulnerability in ApostropheCMS Form Add-on

CVE-2026-113656

What is CVE-2026-113656?

An issue has been identified in the ApostropheCMS Form add-on where form submission routes allow unbounded multipart uploads. This occurs before any form validation or authentication checks are performed, making it possible for an attacker to exploit this by sending numerous unauthenticated submissions. The lack of limits on upload size, count, and rate can lead to excessive consumption of temporary disk storage. In turn, this can disrupt the handling of forms and potentially affect other services on the host, highlighting the importance of updating to version 1.5.5 or later, where this vulnerability has been addressed.

References