CVE-2026-108750 — Vulnerability intelligence
OpenDocMan — OpenDocMan
Published:
- CVSS
- 5.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.