ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storage, temporary processing, and attacker-declared cleanup work before the later user check rejects the import. This issue is fixed in ApostropheCMS 4.33.0 and import-export 3.7.0.

Affected: npm: apostrophe, npm: @apostrophecms/import-export

## Summary

A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`.

The affected import API routes invoke:

`self.apos.http.bigUploadMiddleware()`

before the actual import handler performs its authentication check.

Because no `authorize` callback is supplied to `bigUploadMiddleware()`, unauthenticated requests can reach the `aposBigUpload` `start`, `chunk`, and `end` operations before the later `req.user` check rejects the import.

As a result, an unauthenticated remote attacker can create server-side upload state, write chunk data to upload storage, trigger temporary-file processing, and cause attacker-controlled cleanup operations before authentication is enforced.

## Affected Component

Package:

`@apostrophecms/import-export`

Confirmed affected version:

`3.6.2`

Potential earlier affected versions:

The issue may affect earlier 3.x releases in which the current big-upload-based import implementation is present. I have not yet fully verified the exact introduction version and recommend that the maintainers confirm the affected version range.

## Vulnerability Type

Primary:

**CWE-400 — Uncontrolled Resource Consumption**

Related:

**CWE-306 — Missing Authentication for Critical Function**

**CWE-770 — Allocation of Resources Without Limits or Throttling**

## Technical Details

The page import route registers the following middleware chain:

`packages/import-export/modules/@apostr…