CVE-2026-113656 Details
Description
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size, count, and rate limits. Repeated unauthenticated submissions can consume temporary disk storage and disrupt form handling or other host services. This issue is fixed in ApostropheCMS Form 1.5.5.
A vulnerability in the ApostropheCMS Form add-on, prior to version 1.5.5, allows unauthenticated users to upload files without any size or rate limits. The form submission endpoint processes these uploads before validating the form or authenticating the user, leading to potential disk exhaustion. This unbounded upload can consume temporary disk space, disrupt form processing, and interfere with other services on the host. The issue is exacerbated by the absence of upload limits and the possibility of orphaned files from interrupted transfers.
Users can update to ApostropheCMS Form version 1.5.5, which addresses this vulnerability by implementing upload limits and requiring authentication before processing form submissions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ApostropheCMS Form | < 1.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |