ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5

The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…

Read on GitHub Advisory Database

On 10/21/2026, 03:08 AM, GitHub Advisory Database published "ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-113656.