CVE-2026-113656

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.

Summary The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.

Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]. No limits, no rate limiting, no pre-validation. "CSRF" is a fixed-value double-submit cookie (vulnlab.csrf=csrf, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.

PoC

$ curl -s -c csrfjar.cookies http://localhost:3100/        # get vulnlab.csrf=csrf (any GET)
$ df -P /tmp                                                # before: used=1105212
$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \
      -F "file=@/tmp/opencode/big.bin;type=application/octet-stream" &
   DURING transfer:    used=1148668
   still transferring: used=1226936        # +121MB mid-transfer on disk
   http=500 time=1.78s sent=209715411B     # generic error AFTER full staging
# Anonymous, zero credentials. 200MB written to /tmp pre-validation.

Impact Any unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk /tmp (process/host crash) and saturate the event loop — a trivial remote DoS. Aborted transfers risk orphaning staged files (no req.aborted cleanup).

Remediation — Set multer limits (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on req.aborted/error; add per-IP rate limiting.

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.

Summary The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.

Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]. No limits, no rate limiting, no pre-validation. "CSRF" is a fixed-value double-submit cookie (vulnlab.csrf=csrf, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.

PoC

$ curl -s -c csrfjar.cookies http://localhost:3100/        # get vulnlab.csrf=csrf (any GET)
$ df -P /tmp                                                # before: used=1105212
$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \
      -F "file=@/tmp/opencode/big.bin;type=application/octet-stream" &
   DURING transfer:    used=1148668
   still transferring: used=1226936        # +121MB mid-transfer on disk
   http=500 time=1.78s sent=209715411B     # generic error AFTER full staging
# Anonymous, zero credentials. 200MB written to /tmp pre-validation.

Impact Any unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk /tmp (process/host crash) and saturate the event loop — a trivial remote DoS. Aborted transfers risk orphaning staged files (no req.aborted cleanup).

Remediation — Set multer limits (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on req.aborted/error; add per-IP rate limiting.