Vulnerability Description
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/documenso/documenso
- https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/
- https://github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051
- https://www.vulncheck.com/advisories/documenso-before-2.13.0-unauthenticated-fil
FAQ
What is CVE-2026-82472?
CVE-2026-82472 is a vulnerability with a CVSS score of 7.5 (HIGH). Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitr...
How severe is CVE-2026-82472?
CVE-2026-82472 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82472?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.