ApostropheCMS: Unauthenticated Resource Exhaustion Via Pre-auth AposBigUpload Processing In @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by "@apostrophecms/import-export". The affected import API routes invoke: "self.apos.http.bigUploadMiddleware" before the actual import handler performs its authentication check...

EUVD-2026-105223

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export...

ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

GHSA-86WM-68PQ-5JWQ ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export. The affected import API routes invoke: self.apos.http.bigUploadMiddleware before the actual import handler performs its authentication check. Because ...

CVE-2026-113711

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113711 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113711 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113711

The ApostropheCMS Node.js content management system is vulnerable to unauthenticated resource exhaustion due to improper authorization in the @apostrophecms/import-export module. Specifically, import routes invoke bigUploadMiddleware without an early authorize callback, enabling unauthenticated r...

CVE-2026-113711

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

PT-2026-118589

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 import-export module versions prior to 3.7.0 Description Import routes invoke bigUploadMiddleware without an early authorize callback. This allows unauthenticated requests to perform upload initialization...

Apostrophe Technologies ApostropheCMS Resource Management Vulnerability

Apostrophe Technologies' ApostropheCMS has a resource management vulnerability. This vulnerability stems from the lack of an early authorization callback during the import route call to bigUploadMiddleware. As a result, unvalidated requests are allowed to execute upload initialization, chunk...