Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck

CVE-2026-82472Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

High 7.5

In plain English

A high-severity missing authentication in documenso from documenso. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 44.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

Affected products (as reported)

Vendor	Product	Versions
documenso	documenso	0 – before 2.13.0

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patch Commit patch
https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts technical-description
https://github.com/documenso/documenso product
VulnCheck Advisory: Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf third-party-advisory