OpenDocMan EUVD-2026-96915

Requires an authenticated OpenDocMan account with document-upload permission (PR:L) - exploitation is not possible unauthenticated. The attacker must upload a crafted ODT, DOCX, or XLSX file whose compressed XML entries expand enormously; the DoS specifically triggers when OpenDocMan invokes its text-extraction routine (e.g. OdtExtractor) on the uploaded document, so a deployment that disables or bypasses text extraction would not be affected. No special user interaction beyond a normal upload is needed, and the impact is limited to availability degradation of PHP workers rather than code execution or data exposure. Affected versions are 2.4.0 through 2.10.0.

This is a genuine but low-to-moderate priority issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) scores 5.3 (Medium) and is internally consistent with the description: network-reachable, low complexity, but requires low-privilege authentication (PR:L) and yields only a limited availability impact (VA:L) with zero confidentiality or integrity impact - consistent with CWE-409 (Improper Handling of Highly Compressed Data). No EPSS score, CISA KEV listing, or SSVC decision data was supplied; absence of KEV means there is no evidence of active exploitation. A public technical writeup (hackmd) describing the decompression-bomb technique exists, but no weaponized exploit code is flagged in the input. The limiting factors - valid authenticated access and an impact capped at degraded availability (worker exhaustion, not RCE or data loss) - mean this is realistically an authenticated-insider or compromised-account DoS rather than a wormable mass-exploitation threat. Net: a real, verifiable defect worth patching on a normal cycle, but the combination of required authentication, availability-only impact, and no KEV/EPSS signal argues against treating it as a high-urgency item.

An authenticated user with document-upload rights uploads a small ODT, DOCX, or XLSX file whose internal ZIP/XML entries are crafted to decompress to hundreds of megabytes. When OpenDocMan's text-extraction routine parses the file, PHP memory is exhausted and the worker crashes; repeated uploads degrade or deny service to other users. A public technical writeup documenting the technique exists, lowering the effort to reproduce it.