Vulnerability DatabaseCVE-2026-82472
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-82472
Published:August 29, 2026
Updated:September 24, 2026
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Affected Packages
https://github.com/documenso/documenso.git (GITHUB):
Affected version(s) >=v0.9 <v2.13.0
Fix Suggestion:
Update to version v2.13.0
Related Resources (6)
https://github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114
https://github.com/documenso/documenso
https://www.vulncheck.com/advisories/documenso-before-2.13.0-unauthenticated-file-upload-via-api-files-upload-pdf
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82472.json
https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts
https://nvd.nist.gov/vuln/detail/CVE-2026-82472
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Weakness Type (CWE)
Missing Authentication for Critical Function
CWE-306
EPSS
Base Score:
0.41