{"id":"ghsa-ghsa-qhcq-9pm2-c9w9","seq":2420,"kind":"advisory","title":"ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory","url":"https://github.com/advisories/GHSA-qhcq-9pm2-c9w9","permalink":"https://vulnpulse.app/items/ghsa-ghsa-qhcq-9pm2-c9w9","summary":"影響: npm:apostrophe < 4.33.0 → 4.33.0\nSummary A rejected upload can remain in the operating system temporary directory. Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space. Details The endpoint is: text POST /api/v1/@apostrophecms/rich-text-widget/generate-csv-table In packages/apostrophe/modules/@apostrophecms/rich-text-widget/lib/apiRoutes.js, Multer first writes t…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-113658"],"tags":["GHSA-qhcq-9pm2-c9w9","apostrophe"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:10:32.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}