CVE-2026-82472 json
Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
published 2026-08-29 2 mo ago modified 2026-09-24 45 d ago also EUVD-2026-68128
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- documenso documenso
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
github.com
/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114
patch
-
github.com
/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts
technical-description
-
github.com
/documenso/documenso
product
-
vulncheck.com
/advisories/documenso-before-2.13.0-unauthenticated-file-upload-via-api-files-upload-pdf
third-party-advisory
Sources
- CVE List CVE-2026-82472
- NVD CVE-2026-82472
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.