{"vulnerability": "CVE-2026-108750", "sightings": [{"uuid": "5c85a3a6-2f68-4ab2-bd7f-c80fb9f53e92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108750", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422411655386669", "content": "CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108750https://hackmd.io/@haind03/opendocman-office-document-decompression-doshttps://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44d3cd1c5/application/models/Document.class.php#L67-L75https://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44d3cd1c5/application/models/TextExtractors/OdtExtractor.class.php#L10-L25https://github.com/opendocman/opendocmanhttps://www.vulncheck.com/advisories/opendocman-2.4.0-through-2.10.0-decompression-bomb-dos-via-upload-text-extraction#OpenDocMan#CVE_2026_108750#bot", "creation_timestamp": "2026-10-11T13:03:31.389051Z"}]}