CVE-2026-82472: Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can reach the Documenso /api/files/upload-pdf endpoint can exploit it. No authentication, session token, API credential, or user interaction is required.
What is the practical impact of successful exploitation?
An attacker can repeatedly upload arbitrary PDF files, potentially exhausting available storage. The uploads can also create unlinked document records that fill the database.
Which deployments are affected?
Documenso versions before 2.13.0 are affected where the /api/files/upload-pdf endpoint is reachable by an attacker. The provided information does not identify any configuration prerequisite beyond endpoint access.
How can I check whether my deployment is exposed?
Verify whether the deployed Documenso version is earlier than 2.13.0 and whether /api/files/upload-pdf accepts PDF uploads without authentication. Review storage consumption and database records for unexpected or unlinked uploaded documents.