CVE-2026-82472 | BDVDB-2026-366287 Detail
documensodocumenso
Description#
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
- CWE-306 Missing Authentication for Critical Function
References#
- https://github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114
- https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts
- https://github.com/documenso/documenso
- https://www.vulncheck.com/advisories/documenso-before-2.13.0-unauthenticated-file-upload-via-api-files-upload-pdf
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.