CVE-2026-82472

creationtimestamp| type| source ---|---|--- 2026-08-30 01:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mub6vtnzmm22...

CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...