{"id":"CVE-2026-113656","kind":"vulnerability","aliases":["CVE-2026-113656","GHSA-89mh-mm8c-mv7f"],"related":[],"title":"ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS","description":"**Summary**\nThe form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.\n\n**Details**\n`packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. \"CSRF\" is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.\n\n**PoC**\n```\n$ curl -s -c csrfjar.cookies http://localhost:3100/        # get vulnlab.csrf=csrf (any GET)\n$ df -P /tmp                                                # before: used=1105212\n$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \\\n      -F \"file=@/tmp/opencode/big.bin;type=application/octet-stream\" &\n   DURING transfer:    used=1148668\n   still transferring: used=1226936        # +121MB mid-transfer on disk\n   http=500 time=1.78s sent=209715411B     # generic error AFTER full staging\n# Anonymous, zero credentials. 200MB written to /tmp pre-validation.\n```\n\n**Impact**\nAny unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk `/tmp` (process/host crash) and saturate the event loop — a trivial remote DoS. Aborted transfers risk orphaning staged files (no `req.aborted` cleanup).\n\n\n**Remediation** — Set multer `limits` (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on `req.aborted`/error; add per-IP rate limiting.","summary":"The ApostropheCMS form submission endpoint buffers any uploaded multipart body to the temp directory before checking authentication or whether the form exists, with no size limits. An anonymous attacker can fill server disk space and exhaust resources with large uploads.","severity":"medium","cvss":5.300000190734863,"epss":0.004370000213384628,"exploited":false,"exploited_at":null,"products":[{"name":"@apostrophecms/form","fixed":["1.5.5"],"affected":"< 1.5.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["apostrophecms","cwe-770","node","npm","package","self-hosted"],"not_affected_if":["managed-hosting-with-body-limits","no-form-module","version-1.5.5-or-later"],"how_to_check":"Run npm ls @apostrophecms/form and check whether the resolved version is below 1.5.5.\nIf it is, the POST /api/v1/@apostrophecms/form/submit route is reachable without credentials on the site.","fix":"Upgrade @apostrophecms/form to 1.5.5 or later.\nUntil then, put a request body size limit in front of the submit route at the reverse proxy.","status":"open","published_at":"2026-10-20T17:17:36+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T19:58:23+00:00","updated_at":"2026-10-23T21:57:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:58:23Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @apostrophecms/form to 1.5.5 or later.\nUntil then, put a request body size limit in front of the submit route at the reverse proxy.","summary":"The ApostropheCMS form submission endpoint buffers any uploaded multipart body to the temp directory before checking authentication or whether the form exists, with no size limits. An anonymous attacker can fill server disk space and exhaust resources with large uploads.","category":"package","who_cares":["apostrophecms","npm","self-hosted","node"],"confidence":0.8,"analyst_note":"","how_to_check":"Run npm ls @apostrophecms/form and check whether the resolved version is below 1.5.5.\nIf it is, the POST /api/v1/@apostrophecms/form/submit route is reachable without credentials on the site.","needs_analyst":false,"not_affected_if":["version-1.5.5-or-later","no-form-module","managed-hosting-with-body-limits"],"severity_if_unknown":"medium"},"cost_usd":0.000448,"input_tokens":2751,"output_tokens":346,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'+121':205C '-113656':12A,20A '-2026':11A,19A '-770':24B '/error':310C '/tmp':180C,230C,260C '/tmp/opencode/big.bin':194C '1.78':215C '1105212':183C '1148668':200C '1226936':204C '200mb':227C '209715411b':218C '296':121C '3100':172C '3100/api/v1':190C '500':213C '703':162C '89mh':15A 'abort':272C 'add':311C 'anonym':58B,165C,224C 'api':84C 'api-key':83C 'apiroutes.post.submit':119C 'apostrophecm':1A,22B,32B 'apostrophecms/form':21A 'apostrophecms/form/submit':191C 'application/octet-stream':196C 'async':127C 'attack':59B 'auth/role/existence':290C 'authent':47B,82C 'b':185C 'bodi':40B,103C,114C,246C 'buffer':36B 'c':169C 'check':46B,291C,299C 'cleanup':108C,280C 'client':237C 'cooki':153C 'cpu':253C 'cpu-decod':252C 'crash':262C 'credenti':226C 'csrf':87C,144C,155C,175C 'csrf-equival':86C 'csrfjar.cookies':170C,186C 'curl':167C,184C 'cve':10A,18A 'cwe':23B 'decod':254C 'dest':78C,123C 'detail':117C 'df':178C 'directori':44B 'disk':7A,63B,105C,211C,259C 'disk-exhaust':6A 'dos':9A,271C 'doubl':151C 'double-submit':150C 'endpoint':35B,75C 'entir':244C 'equival':88C 'error':220C 'event':266C 'exhaust':8A,66B,258C 'exist':52B,92C 'express/index.js':160C 'f':192C 'field':286C 'fieldsiz':288C 'file':134C,193C,277C,303C 'files':285C 'filesystem':250C 'fill':61B 'final':132C 'first':305C 'fix':148C 'fixed-valu':147C 'forc':239C 'form':33B,51B,73C,91C 'form-exist':90C 'full':113C,222C 'function':128C 'generic':219C 'get':159C,173C,177C 'ghsa':14A 'ghsa-89mh-mm8c-mv7f':13A 'handler':300C 'host':30B 'http':212C 'impact':234C 'insid':297C 'ip':314C 'key':85C 'l274':120C 'l694':161C 'larg':69B 'limit':56B,97C,136C,139C,284C,316C 'localhost':171C,189C 'logic':93C 'loop':267C 'mb':206C 'mid':208C 'mid-transf':207C 'mm8c':16A 'mount':295C 'multer':77C,122C,283C,294C 'multipart':4A,39B 'mv7f':17A 'node':25B 'npm':26B 'obtain':164C 'occur':109C 'orphan':275C 'os.tmpdir':79C,124C 'p':179C 'packag':27B 'packages/form/index.js':118C 'parallel':256C 'part':287C 'per':106C,313C 'per-ip':312C 'perform':289C 'persist':243C 'poc':166C 'post':188C 'pre':142C,232C 'pre-valid':141C,231C 'process/host':261C 'rate':138C,315C 'read':306C 'receiv':116C 'remedi':281C 'remot':270C 'req':129C 'req.aborted':279C,309C 'request':107C,245C,257C 'resourc':67B 'risk':274C 'run':76C 'satur':264C 'self':29B 'self-host':28B 'self.normalizefiles':126C 'sent':217C 'server':62B,241C 'set':156C,282C 'size':55B 'size/count/rate':96C 'space':64B 'stage':223C,276C,302C 'still':201C 'stream':101C 'submiss':34B,74C 'submit':152C 'submitform':131C 'summari':71C 'temp':43B,249C 'time':214C 'transfer':198C,202C,209C,273C 'tri':130C 'trivial':163C,269C 'type':195C 'unauthent':2A,98C,236C 'unbound':3A,102C 'unlink':133C,301C 'upload':5A,38B,70B 'use':182C,199C,203C 'user':99C 'valid':143C,233C 'valu':149C 'vulnlab.csrf':154C,174C 'whether':49B 'written':228C 'x':187C 'zero':225C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T17:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-89mh-mm8c-mv7f","url":"https://github.com/advisories/GHSA-89mh-mm8c-mv7f","severity":"medium","published_at":"2026-10-20T18:08:31+00:00","modified_at":"2026-10-20T18:08:32+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-113656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113656","severity":null,"published_at":"2026-10-20T17:17:36+00:00","modified_at":"2026-10-21T16:17:24+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}