CVE-2026-113658

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0

Description An unauthenticated user can cause a denial of service by exhausting temporary disk capacity. The issue occurs because the system writes multipart uploads to the temporary directory before validating the file extension and fails to delete the file when validation fails. An attacker can repeatedly send large files to the endpoint '/api/v1/@apostrophecms/rich-text-widget/generate-csv-table' using a standard CSRF cookie to fill the disk partition, potentially disrupting the application and other services on the same host.

Recommendations Update to version 4.33.0. Restrict access to the endpoint '/api/v1/@apostrophecms/rich-text-widget/generate-csv-table' to minimize the risk of exploitation.