Unauthenticated requests to ApostropheCMS import routes can trigger the bigUploadMiddleware before any authorization checks, allowing an attacker to initialize an upload, store chunks, perform temporary processing, and initiate cleanup work. This sequence consumes significant disk space, memory, and CPU resources, potentially leading to system resource exhaustion and a denial of service for legitimate users. The weakness is a classic resource exhaustion flaw identified as CWE-400 and an improper limit setting represented by CWE-770.

The vulnerability affects ApostropheCMS versions prior to 4.33.0 and the import-export module prior to 3.7.0, which are used to host content management sites. Any instance deployed with these legacy versions without additional protective configuration is impacted.

The CVSS score of 7.5 indicates a high severity, suggesting effective exploitation can occur. Although no EPSS score is available, the absence of exposure in CISA KEV does not eliminate risk; the flaw can be triggered by any network user with knowledge of the import route. Attackers can initiate multiple concurrent upload sessions, potentially exhausting host resources without any authentication.