CVE-2026-113658: CWE-400: Uncontrolled Resource Consumption in apostrophecms apostrophe

CVE-2026-113658 describes an uncontrolled resource consumption vulnerability (CWE-400) in ApostropheCMS, an open-source Node.js content management system. Before version 4.33.0, the unauthenticated Rich Text CSV conversion endpoint writes multipart uploads to the system temporary directory before validating the file extension. If the validation rejects the file, the temporary staged file is not removed, allowing an attacker to repeatedly upload large files that accumulate and exhaust disk space. This can disrupt ApostropheCMS and other services relying on the same temporary disk partition. The vulnerability has a CVSS 3.1 score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. The issue is resolved in ApostropheCMS version 4.33.0.

An attacker can cause persistent consumption of disk space on the system temporary directory by repeatedly uploading large rejected files via the unauthenticated Rich Text CSV conversion route. This can lead to denial of service conditions by exhausting disk capacity, disrupting ApostropheCMS and potentially other services sharing the same disk partition. There is no confidentiality or integrity impact reported.

Upgrade ApostropheCMS to version 4.33.0 or later, where this vulnerability is fixed. Until then, consider restricting access to the Rich Text CSV conversion route or monitoring disk usage to prevent exhaustion. No official patch links were provided, but the vendor advisory confirms the fix in 4.33.0.