Apostrophe CMS patch fixes disk exhaustion flaw in rich text widget
Version 4.33.0 resolves a high severity issue where rejected uploads persist in temporary directories, allowing unauthenticated users to fill disk space.
Key points
- CVE-2026-113658 affects npm apostrophe versions below 4.33.0.
- The flaw allows unauthenticated requests to consume temporary disk space.
- Patch version 4.33.0 is available to fix the cleanup failure.
Apostrophe CMS has released version 4.33.0 to address a high severity vulnerability that allows attackers to exhaust server disk space. The flaw, identified as CVE-2026-113658, exists in the rich text widget module and affects all versions prior to the patch.
What happened
The vulnerability stems from how the application handles file uploads for CSV table generation. According to the GitHub advisory, the endpoint does not require authentication, only a standard CSRF cookie. When a user uploads a file with an unsupported extension, the system rejects the request but fails to delete the temporary file created by the Multer middleware.
This behavior leaves the uploaded content in the operating system's temporary directory. An unauthenticated requester can repeatedly send large files to this endpoint. Each rejected upload remains on disk, steadily consuming available storage. Testing showed that even small files persist, while larger files can rapidly fill the volume.
Why it matters
This issue was discovered after reviewing a prior pull request that migrated the upload path from connect-multiparty to Multer. The original review did not identify the missing cleanup step on the error path. Because the endpoint is accessible without login credentials, any internet-facing instance is potentially exposed to this disk exhaustion attack.
What to watch
- Monitor temporary directory sizes for unexpected growth.
- Check server logs for repeated HTTP 400 responses on the rich text widget endpoint.
- Verify that no large, randomly named files are accumulating in os.tmpdir().
- Ensure that file upload handlers clean up temporary data on all error paths.
Who needs to act first
Teams should prioritize updating any public-facing Apostrophe CMS instances running versions older than 4.33.0. Since the flaw allows unauthenticated disk consumption, exposed servers face immediate risk of service disruption. Before applying the patch, administrators should back up their current configuration and database. It is advisable to test the update in a staging environment to ensure compatibility with existing plugins. If immediate patching is not possible, restricting network access to the rich text widget endpoint can reduce exposure.
What to do and how to stay safe: Apostrophe CMS
- Upgrade npm apostrophe to version 4.33.0 or later as soon as possible.
- Audit temporary directories on affected servers for residual files from prior exploits.
- Implement rate limiting on upload endpoints to mitigate abuse while patches are deployed.
- Review other file upload handlers in the application for similar cleanup failures.
Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Apostrophe CMS are affected by CVE-2026-113658?
All versions of the npm apostrophe package below 4.33.0 are vulnerable.
Is authentication required to exploit this vulnerability?
No, the endpoint only requires a standard CSRF cookie, not a logged-in user session.
What is the impact of this vulnerability?
Attackers can steadily consume temporary disk space by uploading large files that are rejected but not deleted.
