CVE-2026-82472
Received Received - Intake

Documenso PDF Upload Allows Unauthenticated Arbitrary File Upload

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: VulnCheck

Description
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-82472
EUVD
EUVD-2026-68128

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
documenso documenso to 2.13.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82472 is an unauthenticated file upload vulnerability in Documenso versions before 2.13.0. The /api/files/upload-pdf endpoint allows attackers to upload arbitrary PDF files without authentication, session tokens, or API credentials. This can lead to storage exhaustion or database flooding with unlinked document records.

Detection Guidance

Check for unauthorized PDF uploads to the /api/files/upload-pdf endpoint by monitoring server logs for POST requests without authentication tokens. Look for repeated upload attempts or large file sizes that may indicate resource exhaustion.

Impact Analysis

This vulnerability allows attackers to upload large or numerous PDF files to your Documenso instance without permission. This can consume all available storage space, degrade system performance, or fill the database with invalid records, disrupting normal operations.

Compliance Impact

The vulnerability allows unauthenticated file uploads, which could lead to unauthorized storage of sensitive documents. This may violate GDPR's data integrity and confidentiality requirements (Article 5) and HIPAA's access controls (45 CFR § 164.312(a)(1)). Uncontrolled storage could also breach retention policies under these regulations.

Mitigation Strategies

Upgrade Documenso to version 2.13.0 or later to patch the unauthenticated file upload vulnerability. If immediate upgrade is not possible, restrict access to the /api/files/upload-pdf endpoint via network-level controls or disable it entirely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82472. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart