Description
Summary The form submission endpoint runs multer({ dest: os.tmpdir() }).any() before authentication, API-key, CSRF-equivalent, or form-existence logic, with no size/count/rate limits. Unauthenticated users can stream unbounded bodies to disk per request; cleanup occurs only after the full body is received.
Details packages/form/index.js apiRoutes.post.submit (L274–296): [ multer({ dest: os.tmpdir() }).any(), self.normalizeFiles, async function (req) { try { submitForm } finally { unlink files } } ]. No limits, no rate limiting, no pre-validation. “CSRF” is a fixed-value double-submit cookie (vulnlab.csrf=csrf, set on any GET, express/index.
Recommendation
Update the @apostrophecms/form package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.5.5
- Patched version(s): 1.5.5
References
Could your website be exposed too?
SmartScanner can check your website for ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS - CVE-2026-54156
- Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution - CVE-2026-34148
- Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) - CVE-2026-116581
- SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header - CVE-2026-66062
