The vulnerability permits an attacker to upload a CSV file without authentication. The conversion route writes the multipart upload to the system temporary directory before validating the file extension and does not delete the rejected file. Repeated large, rejected uploads can accumulate, consuming temporary disk space and potentially causing a denial of service for the content management system and other services sharing the same partition.

The flaw affects ApostropheCMS, an open‑source Node.js content management system, on all releases earlier than 4.33.0. Version 4.33.0 and later contain the fix.

The CVSS score of 7.5 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack is purely unauthenticated, relying on the publicly accessible CSV import route and the CSRF cookie used by the application. An attacker can continuously send large files that are rejected, causing the temporary directory to fill, leading to service disruption. Based on the description, it is inferred that the lack of authentication could make the attack trivial once the application is reachable from the network.