ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5

The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…

在 GitHub Advisory Database 阅读

2026/10/21 03:08，GitHub Advisory Database 发布了“ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-113656。