Description
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

OpenDocMan 2.4.0 through 2.10.0 includes a decompression bomb flaw that lets an authenticated user upload a small office file whose contents decompress to a large size, consuming PHP memory and causing worker processes to crash. This results in a denial of service on the application, potentially affecting all users. The weakness is a form of improper restriction of content from a remote source (CWE-409).

Affected Systems

The vulnerability affects OpenDocMan releases 2.4.0 to 2.10.0. Any environment running those versions is susceptible. Databases or file storage pools that host the application must consider that these releases process office documents (ODT, DOCX, and XLSX).

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the exploitability score is not available, but the flaw does not require additional privileges beyond valid upload rights. Since the issue is not listed in KEV and no EPSS data is present, current public exploitation risk is uncertain. However, an attacker with authenticated access can intentionally deplete memory, crash workers, and degrade availability, making this a critical impact for highly available services.

Generated by OpenCVE AI on October 11, 2026 at 13:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade OpenDocMan to a version that addresses the decompression bomb handling issue or apply the vendor's patch if available.
  • Restrict or disable upload of office document formats that trigger the issue for non-privileged users and impose strict file size limits on uploads.
  • Configure PHP memory_limit and max_execution_time settings to mitigate the effect of large decompressions, or isolate upload handling in a sandboxed process.

Generated by OpenCVE AI on October 11, 2026 at 13:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
Title OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction
First Time appeared Opendocman
Opendocman opendocman
Weaknesses CWE-409
CPEs cpe:2.3:a:opendocman:opendocman:*:*:*:*:*:*:*:*
Vendors & Products Opendocman
Opendocman opendocman
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Opendocman Opendocman
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-11T12:19:50.653Z

Reserved: 2026-10-11T01:53:25.059Z

Link: CVE-2026-108750

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-11T13:17:19.810

Modified: 2026-10-11T13:17:19.810

Link: CVE-2026-108750

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T14:00:18Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)