CVE-2026-108750
Received Received - Intake

Decompression Bomb in OpenDocMan Allows PHP Memory Exhaustion

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108750
EUVD
EUVD-2026-96915

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OpenDocMan OpenDocMan 2.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenDocMan versions 2.4.0 to 2.10.0 have a decompression bomb vulnerability. Authenticated users can upload small office documents like ODT, DOCX, or XLSX files that contain XML entries which decompress to hundreds of megabytes. This causes PHP memory exhaustion, crashing PHP workers and reducing system availability.

Detection Guidance

Detecting this vulnerability requires monitoring for unusually large memory consumption during file uploads or processing. Check PHP memory usage logs for spikes when users upload ODT, DOCX, or XLSX files. Look for failed PHP worker processes or crashes during document handling.

Impact Analysis

This vulnerability can lead to denial of service by consuming excessive server resources. PHP workers may crash, degrading system performance and making the application unavailable to legitimate users. It requires authenticated access but can disrupt operations significantly.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing system unavailability due to PHP memory exhaustion. GDPR requires timely access to personal data, while HIPAA mandates continuous availability of health records. A denial-of-service condition may violate these requirements.

Mitigation Strategies

Limit file upload sizes in OpenDocMan configuration. Implement strict file type validation to block non-office formats. Monitor PHP memory usage and set alerts for abnormal consumption. Consider disabling XML decompression for office files if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108750. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart