Apostrophe CMS import module allows unauthenticated denial of service

Apostrophe CMS has released updates to fix a high-severity denial-of-service flaw in its import functionality. The vulnerability allows unauthenticated attackers to consume server resources before authentication is enforced.

What happened

Researchers identified a flaw in the chunked import upload path used by the @apostrophecms/import-export package for Apostrophe CMS. The issue stems from how the import API routes handle middleware before authentication checks occur. According to the GitHub advisory GHSA-86wm-68pq-5jwq, the affected routes invoke self.apos.http.bigUploadMiddleware() without supplying an authorize callback.

This configuration allows unauthenticated requests to reach the aposBigUpload start, chunk, and end operations. The authentication check that verifies req.user happens only after these operations have already executed. As a result, remote attackers can create server-side upload state and write chunk data to storage without credentials.

The vulnerability is rated high severity. It is classified as CWE-400 uncontrolled resource consumption, with related issues including CWE-306 missing authentication for critical functions and CWE-770 allocation of resources without limits. The flaw enables attackers to trigger temporary-file processing and cleanup operations before the system rejects the request.

Why it matters

The primary risk is resource exhaustion on servers running vulnerable versions of Apostrophe CMS. Because the authentication check occurs too late in the request lifecycle, attackers can force the server to process large amounts of data. This includes writing chunks to storage and managing temporary files, which consumes disk space and processing power.

The confirmed affected version of @apostrophecms/import-export is 3.6.2. Earlier 3.x releases may also be affected if they use the same big-upload-based import implementation. The advisory notes that the exact introduction version has not been fully verified. Maintainers are recommended to confirm the affected range for earlier releases.

Our take on the response

• Update npm apostrophe to version 4.33.0 or later to apply the patch.
• Update npm @apostrophecms/import-export to version 3.7.0 or later to fix the middleware chain.
• Review server logs for unauthenticated requests to import endpoints that resulted in large data transfers.
• Verify that authentication checks are enforced before any resource-intensive middleware executes in custom modules.

What defenders should look for

Security teams should monitor for unusual spikes in disk I/O or temporary file creation on web servers running Apostrophe CMS. Check access logs for POST requests to import endpoints that originate from anonymous sources or lack valid session tokens. Look for repeated attempts to initiate chunked uploads that fail authentication but still generate server-side state. If such activity is detected, immediately block the source IP and clear any orphaned temporary files. Teams should also verify that middleware chains enforce authentication before processing large payloads or writing to disk.

What to do and how to stay safe: Apostrophe CMS

• Audit npm dependencies to identify if your project uses apostrophe versions below 4.33.0 or import-export versions below 3.7.0.
• Review middleware configurations in custom or third-party modules to ensure authentication occurs before resource-intensive operations like file uploads.
• Monitor server storage and CPU usage for sudden increases that could indicate unauthenticated upload attempts.
• Once the vendor provides an update, test the patch in a staging environment to verify that authentication checks are now enforced correctly.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which CVE ID is associated with this Apostrophe CMS vulnerability?

The vulnerability is tracked as CVE-2026-113711.

What is the fixed version for the main Apostrophe CMS package?

The vulnerability is patched in apostrophe version 4.33.0.

Is there a patch available for the import-export package?

Yes, the @apostrophecms/import-export package is patched in version 3.7.0.