Description
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Published: 2026-08-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated File Upload
Action: Upgrade immediately
AI Analysis

Impact

Documenso before version 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring any authentication, session tokens, or API credentials. This flaw allows any remote actor to submit arbitrary PDF files. While the content is not executable, repeated uploads can fill the server’s storage and create thousands of orphaned document records in the database, which in turn can lead to a denial‑of‑service by exhausting disk space or database capacity.

Affected Systems

All installations of Documenso with a version older than 2.13.0 are impacted. The vulnerability resides in the core application and affects any deployment that exposes the upload‑pdf API endpoint without an additional authentication layer.

Risk and Exploitability

The flaw has a CVSS base score of 8.7, denoting high severity, and no EPSS data is currently available. The vulnerability is not listed in the CISA KEV catalog. Because authentication is not required, an attacker can exploit the issue from any network location that can reach the API, making it a high‑risk vector for untrusted networks.

Generated by OpenCVE AI on August 29, 2026 at 17:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Documenso to version 2.13.0 or later to remove the unauthenticated upload functionality.
  • If an upgrade cannot be performed immediately, restrict access to the /api/files/upload-pdf endpoint by requiring authentication or applying network‑level filtering such as firewall rules.
  • Monitor storage utilization and database record counts for sudden increases, and respond promptly to potential denial‑of‑service incidents.

Generated by OpenCVE AI on August 29, 2026 at 17:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 29 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Documenso
Documenso documenso
Vendors & Products Documenso
Documenso documenso

Sat, 29 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Title Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Documenso Documenso
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-17T17:54:45.344Z

Reserved: 2026-08-29T14:11:13.578Z

Link: CVE-2026-82472

cve-icon Vulnrichment

Updated: 2026-08-31T16:34:01.043Z

cve-icon NVD

Status : Received

Published: 2026-08-29T17:17:59.623

Modified: 2026-09-17T18:17:09.550

Link: CVE-2026-82472

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T18:00:12Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function