Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Priority MEDIUM 45CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00755 55th percentileScored 2026-11-07
Fix Fixed documenso (documenso): 2.13.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA documenso (documenso) Fixed in 2.13.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82472
- 2026-10-03 Alias added: GHSA-qm54-2jq3-88j9
References
More documenso vulnerabilities
- TI-2024-34947 PDF Document Spoofing in Documenso CVSS 4.0HIGH 8.2
- TI-2026-58808 Documenso 2.17.0 PDF Route Ignores Document Visibility CVSS 4.0HIGH 7.1
- TI-2026-49917 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-82472 · CVE Program
- CVE-2026-82472 · NVD
- FIRST EPSS
- GHSA-qm54-2jq3-88j9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences