CVE-2026-108750 OpenDocMan CVE debrief

Who should care

Defenders responsible for OpenDocMan installations, particularly in environments with high user upload activity, should assess exposure and prioritize remediation. This includes reviewing OpenDocMan versions, restricting uploads to trusted users, and implementing monitoring for suspicious upload activity and PHP worker crashes. Additionally, defenders should consider disabling office document upload features if not essential and review compensating }}

Why it matters

This decompression bomb vulnerability in OpenDocMan 2.4.0 through 2.10.0 allows authenticated users to cause a denial of service by uploading crafted office documents, potentially leading to PHP worker crashes and system unavailability.

• Potential for denial of service due to PHP worker crashes
• Need for verification of OpenDocMan version and exposure
• Possible impact on system availability and user productivity

Technical summary

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. The vulnerability is caused by the decompression of crafted office documents, which can decompress to hundreds of megabytes, crashing PHP workers and degrading availability. Defenders should prioritize verifying and remediating this vulnerability in OpenDocMan installations, particularly in environments with high user upload activity. The vulnerability can lead to denial of service due to PHP worker crashes and system unavailability.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in OpenDocMan installations, particularly in environments with high user upload activity.

Recommended defensive actions

• Verify OpenDocMan version and restrict uploads to trusted users
• Implement monitoring for suspicious upload activity and PHP worker crashes
• Consider disabling office document upload features if not essential
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the decompression bomb vulnerability in OpenDocMan 2.4.0 through 2.10.0. The vulnerability allows authenticated users to cause a denial of service by uploading crafted office documents. The source item provides additional context on the vulnerability, including its potential impact on system availability and user productivity. To verify exposure, defenders should review OpenDocMan installations and assess the risk of user-uploaded documents. Evidence limits suggest that defenders need

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.