Documenso versions prior to 2.13.0 are vulnerable to an unauthenticated file upload flaw, which allows remote attackers to perform unauthorized uploads and exhaust system resources.

This vulnerability is a missing authentication flaw (CWE-306) affecting the /api/files/upload-pdf endpoint. The application fails to perform any identity verification or session checks, allowing unauthenticated attackers to upload arbitrary PDF files directly to the server.

The ability for unauthenticated users to upload arbitrary files poses a significant risk to system availability and integrity. Attackers can leverage this vulnerability to exhaust storage capacity or flood the database with junk records, leading to service disruption and potential operational downtime. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent malicious actors from abusing the platform's infrastructure.

Immediate Action: Upgrade Documenso to version 2.13.0 or later to implement required authentication checks on the file upload endpoint.

Proactive Monitoring: Monitor server access logs for unusual spikes in traffic to the /api/files/upload-pdf endpoint and audit storage utilization for unexpected growth patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /api/files/upload-pdf path, ideally limiting it to authorized IP ranges or implementing rate limiting to mitigate automated abuse.

Public Exploit Available: Unknown

The absence of authentication on a critical file upload endpoint represents a severe security oversight. Administrators should prioritize updating their Documenso instances to version 2.13.0 immediately. Until an update can be applied, restricting access to the affected endpoint at the network or application firewall level is essential to prevent potential abuse.