CVE-2026-108750

EUVD-2026-96915
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
Data Amplification
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.49%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
opendocmanopendocman
2.4.0 ≤
𝑥
≤ 2.10.0
CNA
Common Weakness Enumeration
References
https://github.com/opendocman/opendocman
https://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44d3cd1c5/application/models/Document.class.php#L67-L75
https://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44d3cd1c5/application/models/TextExtractors/OdtExtractor.class.php#L10-L25
https://hackmd.io/@haind03/opendocman-office-document-decompression-dos
https://www.vulncheck.com/advisories/opendocman-2.4.0-through-2.10.0-decompression-bomb-dos-via-upload-text-extraction