# CVE-2026-82472: Documenso unauthenticated PDF file upload

Source: https://junglewise.ai/threats/cve-2026-82472-documenso-unauthenticated-pdf-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82472 · Severity: high · CVSS 7.5 · Published 2026-08-29

Documenso is an open-source document signing platform used as an alternative to DocuSign. The application's PDF upload endpoint lacks authentication checks, allowing unauthenticated attackers to upload arbitrary PDF files without logging in. An attacker can upload files indefinitely to exhaust server storage, degrade performance, or fill the database with orphaned records, potentially leading to service disruption.

Technologies: [Documenso](https://junglewise.ai/threats/technologies/documenso). Vendors: [Documenso](https://junglewise.ai/threats/vendors/documenso).

## Quick answers

**Is CVE-2026-82472 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82472 being exploited in the wild.

**How severe is CVE-2026-82472?** High severity, with a CVSS score of 7.5, published 29 August 2026.

**Which products and versions are affected?** Documenso before 2.13.0.

**Is there a fix for CVE-2026-82472?** A patch was published on 2026: Fixed in version 2.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82472 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82472?** Check whether you run Documenso at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the `/api/files/upload-pdf` endpoint in Documenso before version 2.13.0. The endpoint fails to validate authentication tokens, session cookies, or API credentials before processing file uploads. An attacker can send POST requests to this endpoint with arbitrary PDF files from any network location without pre-authentication. This allows unrestricted file uploads that exhaust storage resources and pollute the database with unlinked document records, resulting in denial of service. The fix is available in version 2.13.0 and later.

## Affected products

- Documenso Documenso before 2.13.0

## Timeline

- 2026-08-29: disclosed
- 2026: patched: Fixed in version 2.13.0

## References

- [https://github.com/documenso/documenso](https://github.com/documenso/documenso)
- [https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts](https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts)

## Related threats

- [Documenso access control bypass in PDF-serving endpoint](https://junglewise.ai/threats/cve-2026-85697-documenso-access-control-bypass-in-pdf-serving-endpoint)
- [Documenso 2FA bypass in Google OAuth Login](https://junglewise.ai/threats/cve-2026-13543-documenso-2fa-bypass-in-google-oauth-login)