GHSA-89MH-MM8C-MV7F

Vulnerability from github – Published: 2026-10-20 18:08 – Updated: 2026-10-20 18:08
VLAI
Summary
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
Details

Summary The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.

Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]. No limits, no rate limiting, no pre-validation. "CSRF" is a fixed-value double-submit cookie (vulnlab.csrf=csrf, set on any GET, express/index.js L694–703) — trivially obtainable anonymously.

PoC

$ curl -s -c csrfjar.cookies http://localhost:3100/        # get vulnlab.csrf=csrf (any GET)
$ df -P /tmp                                                # before: used=1105212
$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \
      -F "file=@/tmp/opencode/big.bin;type=application/octet-stream" &
   DURING transfer:    used=1148668
   still transferring: used=1226936        # +121MB mid-transfer on disk
   http=500 time=1.78s sent=209715411B     # generic error AFTER full staging
# Anonymous, zero credentials. 200MB written to /tmp pre-validation.

Impact Any unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk /tmp (process/host crash) and saturate the event loop — a trivial remote DoS. Aborted transfers risk orphaning staged files (no req.aborted cleanup).

Remediation — Set multer limits (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on req.aborted/error; add per-IP rate limiting.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@apostrophecms/form"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113656"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-20T18:08:31Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "**Summary**\nThe form submission endpoint runs `multer({ dest: os.tmpdir() }).any()` before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.\n\n**Details**\n`packages/form/index.js` `apiRoutes.post.submit` (L274\u2013296): `[ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]`. No `limits`, no rate limiting, no pre-validation. \"CSRF\" is a fixed-value double-submit cookie (`vulnlab.csrf=csrf`, set on any GET, express/index.js L694\u2013703) \u2014 trivially obtainable anonymously.\n\n**PoC**\n```\n$ curl -s -c csrfjar.cookies http://localhost:3100/        # get vulnlab.csrf=csrf (any GET)\n$ df -P /tmp                                                # before: used=1105212\n$ curl -b csrfjar.cookies -X POST http://localhost:3100/api/v1/@apostrophecms/form/submit \\\n      -F \"file=@/tmp/opencode/big.bin;type=application/octet-stream\" \u0026\n   DURING transfer:    used=1148668\n   still transferring: used=1226936        # +121MB mid-transfer on disk\n   http=500 time=1.78s sent=209715411B     # generic error AFTER full staging\n# Anonymous, zero credentials. 200MB written to /tmp pre-validation.\n```\n\n**Impact**\nAny unauthenticated client can force the server to persist entire request bodies to the temp filesystem and CPU-decode them; parallel requests exhaust disk `/tmp` (process/host crash) and saturate the event loop \u2014 a trivial remote DoS. Aborted transfers risk orphaning staged files (no `req.aborted` cleanup).\n\n\n**Remediation** \u2014 Set multer `limits` (fileSize, fields, parts, fieldSize); perform auth/role/existence checks before the multer mount or inside the checked handler; unlink staged files on first read and on `req.aborted`/error; add per-IP rate limiting.",
  "id": "GHSA-89mh-mm8c-mv7f",
  "modified": "2026-10-20T18:08:31Z",
  "published": "2026-10-20T18:08:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-89mh-mm8c-mv7f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/form@1.5.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS: Unauthenticated unbounded multipart upload \u2192 disk-exhaustion DoS"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.