CVE-2026-82472

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82472
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82472.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82472
Published
2026-08-29T16:35:32Z
Modified
2026-09-19T03:30:15Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Details

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82472.json"
}
References

Affected packages

Git / github.com/documenso/documenso

Affected ranges

Type
GIT
Repo
https://github.com/documenso/documenso
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
40d20ad0680b97e26c16de5970c65a7daee08b2d
Fixed
4f346d3c2d5264f221e4d787e162f16051e44114
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.13.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.9-developer-preview
Other
before-prettier
final-marketing-release
v0.*
v0.9
v1.*
v1.10.0
v1.10.0-rc.0
v1.10.0-rc.1
v1.10.0-rc.2
v1.10.0-rc.3
v1.10.0-rc.4
v1.10.0-rc.5
v1.10.1
v1.10.2
v1.10.3
v1.11.0
v1.11.1
v1.12.0
v1.12.0-rc.0
v1.12.0-rc.1
v1.12.0-rc.2
v1.12.0-rc.3
v1.12.0-rc.4
v1.12.0-rc.5
v1.12.0-rc.6
v1.12.0-rc.7
v1.12.0-rc.8
v1.12.1
v1.12.10
v1.12.2-rc.0
v1.12.2-rc.1
v1.12.2-rc.2
v1.12.2-rc.3
v1.12.2-rc.4
v1.12.2-rc.5
v1.12.2-rc.6
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.12.9
v1.13.0
v1.13.1
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.0-rc.0
v1.3.0-rc.1
v1.3.0-rc.2
v1.3.1
v1.3.1-rc.0
v1.3.1-rc.1
v1.3.1-rc.2
v1.3.2-rc.0
v1.4.0
v1.4.0-rc.0
v1.5.0
v1.5.0-rc.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.5.0-rc.3
v1.5.0-rc.4
v1.5.0-rc.5
v1.5.0-rc.6
v1.5.1
v1.5.1-rc.0
v1.5.2
v1.5.2-rc.0
v1.5.2-rc.1
v1.5.2-rc.2
v1.5.2-rc.3
v1.5.2-rc.4
v1.5.2-rc.5
v1.5.2-rc.6
v1.5.2-rc.7
v1.5.2-rc.8
v1.5.3
v1.5.3-rc.0
v1.5.3-rc.1
v1.5.4
v1.5.4-rc.0
v1.5.4-rc.1
v1.5.4-rc.2
v1.5.4-rc.3
v1.5.4-rc.4
v1.5.4-rc.5
v1.5.5
v1.5.5-rc.0
v1.5.5-rc.1
v1.5.5-rc.2
v1.5.5-rc.3
v1.5.5-rc.4
v1.5.5-rc.5
v1.5.5-rc.6
v1.5.5-rc.7
v1.5.5-rc.8
v1.5.6
v1.5.6-rc.0
v1.5.6-rc.1
v1.5.6-rc.2
v1.5.6-rc.3
v1.5.6-rc.4
v1.6.0
v1.6.0-rc.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.0-rc.3
v1.6.1
v1.6.1-rc.0
v1.6.1-rc.1
v1.7.0
v1.7.0-rc.0
v1.7.0-rc.1
v1.7.0-rc.2
v1.7.0-rc.3
v1.7.0-rc.4
v1.7.0-rc.5
v1.7.1
v1.7.1-rc.0
v1.7.1-rc.1
v1.7.1-rc.2
v1.7.1-rc.3
v1.7.2
v1.7.2-rc.0
v1.7.2-rc.1
v1.7.2-rc.2
v1.7.2-rc.3
v1.7.2-rc.4
v1.8.0
v1.8.0-rc.1
v1.8.0-rc.2
v1.8.0-rc.3
v1.8.0-rc.4
v1.8.1
v1.8.1-rc.0
v1.8.1-rc.1
v1.8.1-rc.2
v1.8.1-rc.3
v1.8.1-rc.4
v1.8.1-rc.5
v1.8.1-rc.6
v1.8.1-rc.7
v1.8.1-rc.8
v1.8.1-rc.9
v1.9.0-rc.0
v1.9.0-rc.1
v1.9.0-rc.10
v1.9.0-rc.11
v1.9.0-rc.2
v1.9.0-rc.3
v1.9.0-rc.4
v1.9.0-rc.5
v1.9.0-rc.6
v1.9.0-rc.7
v1.9.0-rc.8
v1.9.0-rc.9
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.10.0
v2.10.1
v2.11.0
v2.12.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.8.0
v2.8.1
v2.9.0
v2.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82472.json"