CVE-2026-108750
MEDIUM
5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Description
AI Translation Available
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
409
Improper Handling of Highly Compressed Data (Data Amplification)
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Amplification
Dos: Crash, Exit, Or Restart
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Applicable Platforms
All platforms may be affected
https://github.com/opendocman/opendocman
https://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44…
https://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44…
https://hackmd.io/@haind03/opendocman-office-document-decompression-dos
https://www.vulncheck.com/advisories/opendocman-2.4.0-through-2.10.0-decompress…