## ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-113711
- 公開日時: 2026-10-21T13:51:21.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-86wm-68pq-5jwq)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-86wm-68pq-5jwq

影響: npm:apostrophe < 4.33.0 → 4.33.0, npm:@apostrophecms/import-export < 3.7.0 → 3.7.0
Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware() before the actual import handler performs its authentication check. Because no authorize callback is supplied to bigUploadMiddleware(), unauthenticated requests can reach the aposBigUpload start, chunk, and end operations before the later req.user check rejects the import. As…