CVE-2026-108750 — OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attacker…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7