Unvalidated File Upload Vulnerability in ApostropheCMS by Apostrophe

CVE-2026-113658

What is CVE-2026-113658?

ApostropheCMS, an open-source Node.js content management system, has a vulnerability that allows an unauthenticated user to exploit the Rich Text CSV conversion route. In versions prior to 4.33.0, this vulnerability enables an attacker to upload large files without proper validation of their extensions. The system writes these uploads to a temporary directory, and if rejected, the files remain, consuming disk space over time. This can lead to performance issues affecting ApostropheCMS and potentially disrupt other services on the same server partition. The issue has been resolved in version 4.33.0, which includes necessary checks to prevent such unauthorized file uploads.

References