High severity7.5NVD Advisory· Published Aug 29, 2026

CVE-2026-82472

Description

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Documenso/Documensollm-fuzzy
Range: <2.13.0

Patches

Vulnerability mechanics

References

github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.tsnvd
github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114nvd
www.vulncheck.com/advisories/documenso-before-2.13.0-unauthenticated-file-upload-via-api-files-upload-pdfnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000