CVE-2026-113711: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export

A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by @apostrophecms/import-export.

The affected import API routes invoke:

self.apos.http.bigUploadMiddleware()

before the actual import handler performs its authentication check.

Because no authorize callback is supplied to bigUploadMiddleware(), unauthenticated requests can reach the aposBigUpload start, chunk, and end operations before the later req.user check rejects the import.

As a result, an unauthenticated remote attacker can create server-side upload state, write chunk data to upload storage, trigger temporary-file processing, and cause attacker-controlled cleanup operations before authentication is enforced.