CVE-2026-113658 apostrophecms CVE debrief

Who should care

Defenders responsible for ApostropheCMS instances with publicly accessible rich-text-widget endpoints should assess exposure and prioritize remediation. Defenders should verify if the instance has been updated to version 4.33.0 or later. Defenders should implement compensating controls to monitor and limit temporary directory usage.

Why it matters

Unauthenticated CSV import requests in ApostropheCMS can leave rejected uploads in the system temporary directory, potentially allowing for disk space consumption. Defenders should assess exposure and prioritize remediation for instances with publicly accessible rich-text-widget endpoints.

• Potential for disk space consumption through repeated large file uploads
• Need for verification of instance exposure and version assessment
• Requirement for compensating controls to monitor temporary directory usage

Technical summary

The ApostropheCMS rich-text-widget endpoint allows unauthenticated CSV import requests, which can leave rejected uploads in the system temporary directory. This occurs because Multer writes the file before its extension is checked, and the rejection path does not remove the temporary file. The endpoint is: POST /api/v1/@apostrophecms/rich-text-widget/generate-csv-table. In `packages/apostrophe/modules/@apostrophecms/rich-text-widget/lib/apiRoutes.js`, Multer first writes the upload to `os.tmpdir()`. A normal CSRF cookie is sufficient.

Defensive priority

Defenders should assess exposure and prioritize remediation for ApostropheCMS instances with publicly accessible rich-text-widget endpoints.

Recommended defensive actions

• Assess exposure of ApostropheCMS instances with publicly accessible rich-text-widget endpoints
• Verify if the instance has been updated to version 4.33.0 or later
• Implement compensating controls to monitor and limit temporary directory usage
• Consider restricting access to the rich-text-widget endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item detail an unauthenticated CSV import vulnerability in ApostropheCMS, where rejected uploads can remain in the system temporary directory, allowing for potential disk space consumption. During testing, the request returned HTTP 400 with 'Only csv files are supported', while the complete uploaded content remained in a randomly named file in the configured temporary directory after the response. A normal CSRF cookie is sufficient. The rejection path does not remove that temporary file. Multer writes the to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.