CVE-2026-108750 Overview
CVE-2026-108750 is a decompression bomb vulnerability affecting OpenDocMan versions 2.4.0 through 2.10.0. The flaw resides in the office document text extraction routines invoked during file uploads. Authenticated users can submit a small ODT, DOCX, or XLSX archive whose compressed XML entries expand to hundreds of megabytes when parsed. The resulting memory pressure exhausts PHP worker processes and degrades application availability. The vulnerability is categorized under CWE-409: Improper Handling of Highly Compressed Data (Data Amplification).
Critical Impact
An authenticated attacker can upload crafted office documents that exhaust PHP memory and crash workers, causing denial of service on the OpenDocMan application.
Affected Products
- OpenDocMan 2.4.0
- OpenDocMan versions 2.4.1 through 2.9.x
- OpenDocMan 2.10.0
Discovery Timeline
- 2026-10-11 - CVE-2026-108750 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-108750
Vulnerability Analysis
OpenDocMan accepts office document uploads and automatically extracts their textual content for indexing. Office formats such as ODT, DOCX, and XLSX are ZIP archives containing XML payloads. The extraction routines in Document.class.php and OdtExtractor.class.php open the archive, read the inner XML entries, and load their decompressed content into memory without bounding the output size.
An attacker with upload privileges can craft a ZIP archive containing highly compressible XML, such as repeated whitespace or null bytes, producing a file only a few kilobytes in size that expands to hundreds of megabytes on read. Each upload consumes a PHP worker's memory until the memory_limit is exceeded, terminating the request handler.
Repeated submissions amplify the condition, exhausting the PHP-FPM or Apache worker pool and preventing legitimate requests from being serviced. The impact is bounded to availability, with no direct effect on confidentiality or integrity.
Root Cause
The extractors call PHP's archive and XML APIs without enforcing a maximum decompressed size, compression ratio ceiling, or streaming read strategy. See the Document.class.php extraction logic and the OdtExtractor.class.php routine for the vulnerable code paths.
Attack Vector
Exploitation requires an authenticated session with document upload permission. The attacker uploads a malicious ODT, DOCX, or XLSX file through the standard document submission interface. The server-side text extraction routine then reads the compressed XML into memory, triggering the exhaustion condition described in the VulnCheck advisory and the HackMD proof-of-concept writeup.
No synthetic exploitation code is reproduced here. Refer to the linked advisories for payload construction details.
Detection Methods for CVE-2026-108750
Indicators of Compromise
- PHP error logs showing repeated Allowed memory size of X bytes exhausted events originating in the Document or OdtExtractor classes.
- Sudden spikes in PHP-FPM worker restarts or 502/504 gateway responses from the OpenDocMan web tier.
- Uploaded office documents with abnormally small file sizes but extremely high internal compression ratios (archive-to-content ratios above 1:1000).
Detection Strategies
- Inspect uploaded archive files with a pre-processing check that reports the ratio between compressed and uncompressed entry sizes before text extraction runs.
- Alert on repeated upload activity from a single authenticated account that correlates in time with PHP worker crashes.
- Review web access logs for successive POST requests to the OpenDocMan upload endpoint from the same session identifier.
Monitoring Recommendations
- Monitor PHP memory usage, worker restart counts, and request latency on hosts running OpenDocMan.
- Capture process telemetry from the web server tier to correlate upload events with resource exhaustion signatures.
- Track authenticated user activity associated with document uploads and flag anomalous volumes.
How to Mitigate CVE-2026-108750
Immediate Actions Required
- Restrict document upload privileges to trusted users while a fix is being deployed.
- Lower the PHP upload_max_filesize and post_max_size directives to minimize usable payload size.
- Place a reverse proxy or web application firewall rule in front of the upload endpoint to reject requests whose archive entries exceed a defined decompressed-size threshold.
Patch Information
As of the NVD publication date, no fixed version has been identified in the CVE record. Monitor the OpenDocMan GitHub repository and the VulnCheck advisory for the official patched release.
Workarounds
- Disable automatic text extraction on upload until the application enforces decompressed-size limits in Document.class.php and OdtExtractor.class.php.
- Reduce the PHP memory_limit for the OpenDocMan worker pool so that a single crafted document cannot consume disproportionate resources.
- Isolate the OpenDocMan service in a dedicated worker pool so that extractor-induced crashes do not affect other PHP applications on the host.
# Configuration example: tighten PHP limits for the OpenDocMan pool
# /etc/php/8.2/fpm/pool.d/opendocman.conf
php_admin_value[memory_limit] = 64M
php_admin_value[upload_max_filesize] = 8M
php_admin_value[post_max_size] = 10M
php_admin_value[max_execution_time] = 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
