Documenso EUVD-2026-68128

The /api/files/upload-pdf endpoint must be reachable over the network - no authentication, session token, or API credential is required (CVSS PR:N, UI:N confirms zero authentication prerequisite). The only condition is that the Documenso instance runs a version prior to 2.13.0 and the endpoint is not blocked by a reverse proxy, firewall, or WAF rule. No special application configuration, feature flag, or non-default setting is needed; this is the default state of all affected versions. Exploitation is bounded to availability impact only - no confidential document data is accessible and no code execution path exists. The limiting factor for real-world impact is whether the instance has independent storage quotas or rate limiting at the infrastructure layer, which would reduce but not eliminate the attack surface.

The CVSS 4.0 score of 8.7 is well-calibrated for this class of flaw: the network-accessible, zero-prerequisite attack with high availability impact justifies the rating, and the confirmed VC:N/VI:N metrics correctly scope the impact to denial-of-service only - there is no data exfiltration or code execution path here. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically, but the attack mechanics (a simple looped HTTP POST) are well within reach of any script, making automated abuse plausible without specialized tooling. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, which moderates urgency relative to the raw score. Risk is highest for self-hosted Documenso deployments with the API directly internet-exposed; instances behind authenticated reverse proxies or with strict WAF rules restricting /api/files/upload-pdf may have existing compensating controls. The lack of auth bypass for confidential data and the purely availability-focused impact class this as a high-priority operational risk rather than a critical security breach risk.

An attacker scripting a simple loop of HTTP POST requests - using curl or any HTTP library - to /api/files/upload-pdf on an internet-exposed Documenso instance can rapidly exhaust available disk or object storage and generate thousands of orphaned database rows, degrading or denying service to legitimate document signing workflows. No authentication credential, API key, or prior knowledge of the application is required. The attack is fully automatable and scalable from a single machine or distributed across a botnet to accelerate storage exhaustion.