CVE-2026-108750 Details

A decompression bomb vulnerability has been identified in OpenDocMan versions 2.4.0 through 2.10.0. This vulnerability allows authenticated users to exhaust PHP memory by uploading specially crafted office documents. The issue arises because the application indexes the text of uploaded documents at the same time, using a synchronous process that can be manipulated. Attackers can upload a small ODT, DOCX, or XLSX file that, once decompressed, expands to hundreds of megabytes. This causes PHP workers to crash, degrading the application's availability.

The vulnerability can be addressed by adding checks on the uncompressed size and compression ratio of the uploaded files before extraction. This would prevent excessively large decompressions that can lead to memory exhaustion. Additionally, moving the text extraction process to a background job after the upload is approved can help mitigate the impact on PHP workers.