CVE-2026-82472
HighCVSS 7.5Summary
Documenso before version 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Risk Assessment
The risk includes the possibility of exhausting system resources and cluttering the database, which could lead to service disruption and loss of availability.
Recommendation
It is recommended to update Documenso to version 2.13.0 or later, which requires authentication for file uploads, and to implement limits on file size and number of uploads.
Other vulnerabilities in Documenso
See all- CVE-2026-71247Medium
In Documenso, sign-field-with-token.ts used by the live document-signing UI allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.
- CVE-2026-13543Medium
A vulnerability was found in Documenso up to version 2.11.0 in the Google OAuth Login component. An unknown function in handle-oauth-callback-url.ts leads to improper authentication. The attack can be launched remotely but is difficult to exploit due to high complexity.
Original NVD description (English source)
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.