THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-82472 (HIGH 7.5) — Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database wit

[NVD] CVE-2026-82472 (HIGH 7.5) — Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database wit

mednvdPublished 2026-08-29

CVE-2026-82472 CVSS: 7.5 HIGH Published: 2026-08-29T17:17:59.623

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-82472cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-82472