Vendor
Documenso versions prior to 2.13.0 allow unauthenticated attackers to perform arbitrary PDF file uploads via the /api/files/upload-pdf endpoint, potentially resulting in resource exhaustion.