Description

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-29T17:17:59.623Z",
  "pubdate": "2026-08-29T17:17:59.623Z",
  "executiveSummary": "Documenso versions prior to 2.13.0 are vulnerable to an unauthenticated arbitrary file upload vulnerability located on the /api/files/upload-pdf endpoint. This vulnerability allows remote, unauthenticated attackers to upload arbitrary PDF files to the server, bypassing all authentication, session validation, or API credential requirements.\nThe primary risk associated with this flaw is a Denial-of-Service (DoS) condition caused by resource exhaustion. By flooding the application with unauthorized PDF uploads, an attacker can rapidly consume server disk space, saturate storage quotas, and bloat the backend database with unlinked document records, potentially rendering the service unavailable to legitimate users. Because the endpoint does not perform any authorization checks, the barrier to entry for an attacker is minimal. Successful exploitation requires only network connectivity to the targeted Documenso instance. This vulnerability poses significant operational risks to system integrity and availability, necessitating immediate patching to version 2.13.0 or later to implement required access control mechanisms.",
  "technicalDetails": "The vulnerability resides within the /api/files/upload-pdf endpoint of the Documenso application. Analysis indicates that this specific route lacks the necessary middleware or security interceptors to enforce authentication, session token validation, or API key verification. Consequently, the application treats incoming HTTP POST requests to this endpoint as publicly accessible, allowing any remote actor to trigger the file processing logic.\nThe root cause is a failure in access control implementation at the API routing level. By design, the endpoint is intended to facilitate document ingestion; however, the lack of a privilege requirement allows the application to ingest arbitrary PDF files from unauthenticated sources without associating them with a valid user session or legitimate document upload flow.\nThe attack flow proceeds as follows: An attacker identifies the target /api/files/upload-pdf endpoint. Using automated scripts or tools such as cURL or Burp Suite, the attacker sends multiple multipart/form-data POST requests containing PDF payloads. Because the application logic does not perform authentication checks, the server proceeds to process the input, validates the file format (PDF), and writes the file to the configured storage backend (e.g., local disk, S3). Simultaneously, the application backend creates corresponding records within the database to track these document metadata.\nExploitation behavior involves sustained, high-volume uploads to intentionally exhaust server resources. As the application is not rate-limited for this specific unauthenticated path, the attacker can repeatedly execute the upload process. This leads to several technical impacts: First, the storage volume allocated to the Documenso instance is exhausted, preventing legitimate document uploads. Second, the database becomes saturated with orphan records—metadata entries for documents that were uploaded but never linked to a valid user account or process. Third, if the application performs any server-side processing or indexing on newly uploaded PDFs, this will incur unnecessary CPU and memory overhead, contributing to application-wide latency or service instability.\nAffected versions are strictly limited to all versions of Documenso preceding 2.13.0. The vulnerability is categorized as an improper access control issue, specifically an Unauthenticated File Upload leading to Denial-of-Service (DoS)."
}