ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5

The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…

GitHub Advisory Databaseで読む

2026/10/21 03:08、GitHub Advisory Databaseが「ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-113656。