CVE-2026-113656

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.

Affected

apostrophecms · @apostrophecms · apostrophe · form

CVSS v3.1 GITHUB

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.46% chance of exploitation in the next 30 days, 40th percentile

Published

2026-10-20

Updated

2026-10-21

Proof-of-concept exploits (1)

• advisories/GHSA-89mh-mm8c-mv7ffind archive

CVE references

• apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ceREFERENCE
• apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350REFERENCE
• apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5REFERENCE
• apostrophecms/apostrophe/security/advisories/GHSA-89mh-mm8c-mv7fREFERENCE

References

• CVE Record
• NVD entry