ApostropheCMS Form versions prior to 1.5.5 allow unauthenticated users to submit multipart form uploads without any limits on size, count, or rate. Each upload is stored temporarily on disk before validation or authentication, so repeated submissions can consume large amounts of temporary storage, potentially exhausting capacity and causing the form handler or other services on the host to become unresponsive. The weakness is an instance of CWE‑770: Uncontrolled Resource Consumption.

The vulnerability affects installations that use the ApostropheCMS Form add‑on and the core ApostropheCMS platform before version 1.5.5 of the Form component. Users running any earlier Form releases can be impacted, with the specific affected modules being @apostrophecms:form and apostrophecms:apostrophe. No version ranges are supplied beyond the fact that fixes begin at Form 1.5.5.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via HTTP POST requests to the form submission route, inferred from the fact that unauthenticated form submissions are possible. Exploitation requires the attacker to repeatedly submit large multipart payloads; success leads to denial of service but does not compromise confidentiality or integrity.