ApostropheCMS EUVD-2026-105188

Requires that the vulnerable ApostropheCMS Rich Text CSV conversion route (present by default prior to 4.33.0) be network-reachable; no authentication or non-default configuration is needed because the route is unauthenticated and only requires the normal public CSRF cookie that any anonymous client is issued. Realistic impact is LIMITED by the need to sustain repeated large uploads over time rather than a single request, and by deployment specifics: the severity of disruption depends on the size of the system temp partition and whether other services share that same partition. No user interaction and no elevated privileges are required.

This is a genuine but moderate-severity availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) accurately reflects a remote, unauthenticated, low-complexity attack whose entire impact is availability (C:N/I:N) via CWE-400 resource exhaustion - there is no code execution, data disclosure, or integrity loss. No EPSS probability was provided in the input, so exploitation likelihood cannot be quantified. There is no CISA KEV listing and no public exploit was identified, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The 7.5 score is driven purely by the A:H component; weighed against real-world consequences, this is a resource-starvation DoS that requires an attacker to sustain repeated large uploads rather than a single decisive exploit, so it sits below RCE/data-breach class issues of the same numeric score. One nuance to verify: the description states exhaustion 'may disrupt ApostropheCMS and other services that depend on the same partition,' which is arguably a scope change (S:C) that the input's S:U vector does not capture - actual blast radius depends on whether the temp partition is shared.

An attacker fetches the freely available public CSRF cookie that any anonymous visitor receives, then repeatedly POSTs large files to the unauthenticated Rich Text CSV conversion route. Each upload is written to the system temp directory before its extension is validated, and rejected files are never cleaned up, so sustained requests progressively fill the temporary disk until ApostropheCMS and any co-located services on the same partition fail. No public exploit code was identified, but the attack requires no special tooling and no authentication.