CVE-2026-108750: OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenDocMan user who can upload documents can exploit it. The attack is network-reachable and does not require user interaction.
Which uploads are relevant?
Crafted ODT, DOCX, or XLSX files are relevant because their XML entries can decompress to hundreds of megabytes despite the uploaded file being small.
What is the operational impact?
Processing a malicious document can exhaust PHP memory, crash PHP workers, and degrade application availability. The provided impact information indicates availability impact only, with no confidentiality or integrity impact stated.
How can teams determine whether they are affected?
Systems running OpenDocMan versions 2.4.0 through 2.10.0 are affected according to the provided data. Review whether authenticated users are permitted to upload ODT, DOCX, or XLSX documents that undergo text extraction.