Summary
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
A rejected upload can remain in the operating system temporary directory.
Multer writes the file before its extension is checked, and the rejection path does not remove that temporary file. An unauthenticated requester can repeat this with large files and steadily consume temporary disk space.
Details
The endpoint is:
POST /api/v1/@apostrophecms/rich-text-widget/generate-csv-table
In packages/apostrophe/modules/@apostrophecms/rich-text-widget/lib/apiRoutes.js, Multer first writes the upload to os.tmpdir(). The handler then rejects filenames whose extension is not csv, but there is no cleanup of the Multer file on this error path.
The route does not require an authenticated user. A normal CSRF cookie is sufficient.
During testing, the request returned HTTP 400 with Only csv files are supported, while the complete uploaded content remained in a randomly named file in the configured temporary directory after the response.
Relationship to prior public work
I reviewed PR #5013, which migrated the Rich Text CSV upload path from connect-multiparty to Multer. This report concerns cleanup after that migration: the rejected Multer file remains on disk, a behavior not described in the PR or its review discussion.
POC
Create a small test file. A larger file can be used to demonstrate disk growth, but 1 MiB is enough for a safe local reproduction:
dd if=/dev/zero of=rejected.txt bs=1M count=1
Obtain the normal site cookies and send the rejected upload:
curl -c cookies.txt 'http://127.0.0.1:3000/' > /dev/null
curl -i -b cookies.txt \
-F '[email protected];filename=rejected.txt;type=text/plain' \
'http://127.0.0.1:3000/api/v1/@apostrophecms/rich-text-widget/generate-csv-table'
The response is HTTP 400. Compare the contents of the system temporary directory before and after the request:
ls -lt /tmp
A new randomly named file remains present and contains the uploaded bytes.
No login is required. Repeating the multipart request creates additional persistent temporary files.
Impact
A remote unauthenticated attacker can fill the partition used by the operating system temporary directory. Once that partition is exhausted, Apostrophe and unrelated services on the same host may fail to upload files, create temporary data, or continue operating normally.
The attack requires only repeated HTTP requests and the stored files remain after each rejected response.
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
CVE-2026-113658 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.33.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-113658? CVE-2026-113658 is a high-severity uncontrolled resource consumption vulnerability in apostrophe (npm), affecting versions < 4.33.0. It is fixed in 4.33.0. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- How severe is CVE-2026-113658? CVE-2026-113658 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of apostrophe are affected by CVE-2026-113658? apostrophe (npm) versions < 4.33.0 is affected.
- Is there a fix for CVE-2026-113658? Yes. CVE-2026-113658 is fixed in 4.33.0. Upgrade to this version or later.
- Is CVE-2026-113658 exploitable, and should I be worried? Whether CVE-2026-113658 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-113658 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-113658? Upgrade
apostropheto 4.33.0 or later.