ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

影響: npm:apostrophe < 4.33.0 → 4.33.0, npm:@apostrophecms/import-export < 3.7.0 → 3.7.0

A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware() before the actual import handler performs its authentication check. Because no authorize callback is supplied to bigUploadMiddleware(), unauthenticated requests can reach the aposBigUpload start, chunk, and end operations before the later req.user check rejects the import. As…

在 GitHub Advisory Database 阅读

2026/10/21 22:51，GitHub Advisory Database 发布了“ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-113711。