ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

影響: npm:@apostrophecms/form < 1.5.5 → 1.5.5

The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received. Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files }…

GitHub Advisory Database에서 읽기

2026. 10. 21. 오전 03:08, GitHub Advisory Database에서 "ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-113656.