Search
Find a vulnerability
Search criteria
30 vulnerabilities by docmost
CVE-2026-65827 (GCVE-0-2026-65827)
Vulnerability from nvd – Published: 2026-09-24 18:28 – Updated: 2026-09-24 19:22
VLAI
EPSS
VEX
Title
Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service
Summary
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 19:22 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/0411088… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.95.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T19:22:03.264160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:22:12.940Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.21.0, \u003c 0.95.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:28:36.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-frjw-66gr-799m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-frjw-66gr-799m"
},
{
"name": "https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.95.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.95.0"
}
],
"source": {
"advisory": "GHSA-frjw-66gr-799m",
"discovery": "UNKNOWN"
},
"title": "Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65827",
"datePublished": "2026-09-24T18:28:36.809Z",
"dateReserved": "2026-07-22T23:16:47.752Z",
"dateUpdated": "2026-09-24T19:22:12.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52853 (GCVE-0-2026-52853)
Vulnerability from nvd – Published: 2026-09-24 18:31 – Updated: 2026-09-24 18:31
VLAI
EPSS
VEX
Title
Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.
Severity
5.2 (Medium)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/pull/2250 | x_refsource_MISC |
| https://github.com/docmost/docmost/commit/33895b0… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.90.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.90.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace\u0027s highest privilege level. This issue is fixed in version 0.90.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:31:54.486Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx"
},
{
"name": "https://github.com/docmost/docmost/pull/2250",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/pull/2250"
},
{
"name": "https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.90.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.90.1"
}
],
"source": {
"advisory": "GHSA-84fx-mvqx-p5gx",
"discovery": "UNKNOWN"
},
"title": "Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52853",
"datePublished": "2026-09-24T18:31:54.486Z",
"dateReserved": "2026-06-08T18:41:27.724Z",
"dateUpdated": "2026-09-24T18:31:54.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52850 (GCVE-0-2026-52850)
Vulnerability from nvd – Published: 2026-09-24 18:30 – Updated: 2026-09-29 03:08
VLAI
EPSS
VEX
Title
Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 03:08 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/830b5b4… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.90.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T03:08:11.300076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:08:21.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.90.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:30:06.702Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq"
},
{
"name": "https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.90.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.90.1"
}
],
"source": {
"advisory": "GHSA-5vhf-cgf2-c9cq",
"discovery": "UNKNOWN"
},
"title": "Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52850",
"datePublished": "2026-09-24T18:30:06.702Z",
"dateReserved": "2026-06-08T18:41:27.724Z",
"dateUpdated": "2026-09-29T03:08:21.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48073 (GCVE-0-2026-48073)
Vulnerability from nvd – Published: 2026-09-24 18:33 – Updated: 2026-09-24 19:23
VLAI
EPSS
VEX
Title
Docmost: Page export can include restricted same-space attachments through forged attachmentId
Summary
Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 19:23 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/a573ace… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.80.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T19:23:15.132872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:23:23.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.70.0, \u003c 0.80.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:33:20.729Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-rxm9-xp9h-4c84",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-rxm9-xp9h-4c84"
},
{
"name": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.80.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.80.1"
}
],
"source": {
"advisory": "GHSA-rxm9-xp9h-4c84",
"discovery": "UNKNOWN"
},
"title": "Docmost: Page export can include restricted same-space attachments through forged attachmentId"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48073",
"datePublished": "2026-09-24T18:33:20.729Z",
"dateReserved": "2026-05-20T18:25:25.708Z",
"dateUpdated": "2026-09-24T19:23:23.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48072 (GCVE-0-2026-48072)
Vulnerability from nvd – Published: 2026-09-24 18:30 – Updated: 2026-09-24 18:48
VLAI
EPSS
VEX
Title
Docmost: Public image fileName path traversal leads to unauthorized local file read
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 18:47 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/a573ace… | x_refsource_MISC |
| https://github.com/docmost/docmost/commit/ec83fc8… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.80.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T18:47:04.473169Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:48:38.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.80.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route\u0027s UUID check. This issue is fixed in version 0.80.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:30:57.781Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2"
},
{
"name": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5"
},
{
"name": "https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.80.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.80.1"
}
],
"source": {
"advisory": "GHSA-9f58-29hm-mgp2",
"discovery": "UNKNOWN"
},
"title": "Docmost: Public image fileName path traversal leads to unauthorized local file read"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48072",
"datePublished": "2026-09-24T18:30:57.781Z",
"dateReserved": "2026-05-20T18:25:25.708Z",
"dateUpdated": "2026-09-24T18:48:38.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48070 (GCVE-0-2026-48070)
Vulnerability from nvd – Published: 2026-09-24 18:15 – Updated: 2026-09-24 18:15
VLAI
EPSS
VEX
Title
Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.
Severity
7.1 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/a573ace… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.80.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.80.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:15:58.700Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248"
},
{
"name": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.80.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.80.1"
}
],
"source": {
"advisory": "GHSA-95f8-h5hf-8248",
"discovery": "UNKNOWN"
},
"title": "Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48070",
"datePublished": "2026-09-24T18:15:58.700Z",
"dateReserved": "2026-05-20T18:25:25.708Z",
"dateUpdated": "2026-09-24T18:15:58.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40927 (GCVE-0-2026-40927)
Vulnerability from nvd – Published: 2026-04-21 20:52 – Updated: 2026-04-22 17:42
VLAI
EPSS
VEX
Title
Docmost: XSS in Comments with JavaScript URI
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-22 17:41 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40927",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T17:41:58.570551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T17:42:15.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.80.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T20:52:29.313Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-4gv6-jw3v-wc34",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-4gv6-jw3v-wc34"
}
],
"source": {
"advisory": "GHSA-4gv6-jw3v-wc34",
"discovery": "UNKNOWN"
},
"title": "Docmost: XSS in Comments with JavaScript URI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40927",
"datePublished": "2026-04-21T20:52:29.313Z",
"dateReserved": "2026-04-15T20:40:15.517Z",
"dateUpdated": "2026-04-22T17:42:15.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34213 (GCVE-0-2026-34213)
Vulnerability from nvd – Published: 2026-04-14 21:49 – Updated: 2026-04-15 13:31
VLAI
EPSS
VEX
Title
Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation
Summary
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 13:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T13:31:11.461730Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T13:31:17.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.0, \u003c 0.71.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page\u0027s attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:49:55.380Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-89fp-2hch-j9gp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-89fp-2hch-j9gp"
}
],
"source": {
"advisory": "GHSA-89fp-2hch-j9gp",
"discovery": "UNKNOWN"
},
"title": "Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34213",
"datePublished": "2026-04-14T21:49:55.380Z",
"dateReserved": "2026-03-26T15:57:52.324Z",
"dateUpdated": "2026-04-15T13:31:17.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34212 (GCVE-0-2026-34212)
Vulnerability from nvd – Published: 2026-04-14 21:42 – Updated: 2026-04-15 20:02
VLAI
EPSS
VEX
Title
Docmost page content has stored XSS via unsanitized attachment URLs
Summary
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 18:56 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T18:56:22.513458Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T20:02:55.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.71.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:42:44.202Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w"
}
],
"source": {
"advisory": "GHSA-cf68-cff9-hq4w",
"discovery": "UNKNOWN"
},
"title": "Docmost page content has stored XSS via unsanitized attachment URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34212",
"datePublished": "2026-04-14T21:42:44.202Z",
"dateReserved": "2026-03-26T15:57:52.324Z",
"dateUpdated": "2026-04-15T20:02:55.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33193 (GCVE-0-2026-33193)
Vulnerability from nvd – Published: 2026-04-14 21:39 – Updated: 2026-04-16 13:51
VLAI
EPSS
VEX
Title
Docmost vulnerable to stored XSS via MIME type spoofing
Summary
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-16 13:51 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-16T13:51:25.793213Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T13:51:42.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.70.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:39:45.500Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-7cq4-577p-wp6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-7cq4-577p-wp6p"
}
],
"source": {
"advisory": "GHSA-7cq4-577p-wp6p",
"discovery": "UNKNOWN"
},
"title": "Docmost vulnerable to stored XSS via MIME type spoofing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33193",
"datePublished": "2026-04-14T21:39:45.500Z",
"dateReserved": "2026-03-17T22:16:36.721Z",
"dateUpdated": "2026-04-16T13:51:42.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33146 (GCVE-0-2026-33146)
Vulnerability from nvd – Published: 2026-04-14 21:36 – Updated: 2026-04-15 14:28
VLAI
EPSS
VEX
Title
Docmost's Public Share Search Exposes Metadata of Restricted Children
Summary
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 14:27 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T14:27:54.646474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T14:28:08.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.70.0, \u003c 0.70.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:36:53.562Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-qq4c-8rjr-w42c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-qq4c-8rjr-w42c"
}
],
"source": {
"advisory": "GHSA-qq4c-8rjr-w42c",
"discovery": "UNKNOWN"
},
"title": "Docmost\u0027s Public Share Search Exposes Metadata of Restricted Children"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33146",
"datePublished": "2026-04-14T21:36:53.562Z",
"dateReserved": "2026-03-17T21:17:08.884Z",
"dateUpdated": "2026-04-15T14:28:08.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24045 (GCVE-0-2026-24045)
Vulnerability from nvd – Published: 2026-02-10 16:56 – Updated: 2026-04-14 21:36
VLAI
EPSS
VEX
Title
Docmost Affected by Stored XSS in Public Share Page
Summary
Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.
Severity
7.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 18:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/f3f74c5… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.25.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24045",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-10T18:55:53.971510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-10T18:55:58.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.20.0, \u003c 0.25.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:36:07.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq"
},
{
"name": "https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.25.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.25.0"
}
],
"source": {
"advisory": "GHSA-h7fp-4f37-29wq",
"discovery": "UNKNOWN"
},
"title": "Docmost Affected by Stored XSS in Public Share Page"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24045",
"datePublished": "2026-02-10T16:56:37.966Z",
"dateReserved": "2026-01-20T22:30:11.777Z",
"dateUpdated": "2026-04-14T21:36:07.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23630 (GCVE-0-2026-23630)
Vulnerability from nvd – Published: 2026-01-21 22:51 – Updated: 2026-01-22 16:49
VLAI
EPSS
VEX
Title
Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering
Summary
Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-22 15:09 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/cb9f27d… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.24.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23630",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T15:09:16.399808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T16:49:01.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.0, \u003c 0.24.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T22:51:27.158Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwj"
},
{
"name": "https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427daf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427daf"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.24.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.24.0"
}
],
"source": {
"advisory": "GHSA-r4hj-mc62-jmwj",
"discovery": "UNKNOWN"
},
"title": "Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23630",
"datePublished": "2026-01-21T22:51:27.158Z",
"dateReserved": "2026-01-14T16:08:37.482Z",
"dateUpdated": "2026-01-22T16:49:01.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22249 (GCVE-0-2026-22249)
Vulnerability from nvd – Published: 2026-01-15 18:43 – Updated: 2026-01-15 19:08
VLAI
EPSS
VEX
Title
Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)
Summary
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-15 19:08 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/pull/1753 | x_refsource_MISC |
| https://github.com/docmost/docmost/commit/c3b350d… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.24.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22249",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-15T19:08:23.115194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T19:08:26.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.24.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T18:43:56.263Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg"
},
{
"name": "https://github.com/docmost/docmost/pull/1753",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/pull/1753"
},
{
"name": "https://github.com/docmost/docmost/commit/c3b350d943108552e20654580005cd6f6c78ab05",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/c3b350d943108552e20654580005cd6f6c78ab05"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.24.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.24.0"
}
],
"source": {
"advisory": "GHSA-54pm-hqxm-54wg",
"discovery": "UNKNOWN"
},
"title": "Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22249",
"datePublished": "2026-01-15T18:43:56.263Z",
"dateReserved": "2026-01-07T05:19:12.921Z",
"dateUpdated": "2026-01-15T19:08:26.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55574 (GCVE-0-2025-55574)
Vulnerability from nvd – Published: 2025-08-25 00:00 – Updated: 2025-08-25 16:03
VLAI
EPSS
VEX
Summary
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-25 16:02 UTC
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-55574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-25T16:02:34.790963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-25T16:03:37.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-25T15:47:47.587Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/docmost/docmost"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-55574",
"datePublished": "2025-08-25T00:00:00.000Z",
"dateReserved": "2025-08-13T00:00:00.000Z",
"dateUpdated": "2025-08-25T16:03:37.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-48073 (GCVE-0-2026-48073)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:33 – Updated: 2026-09-24 19:23
VLAI
EPSS
VEX
Title
Docmost: Page export can include restricted same-space attachments through forged attachmentId
Summary
Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 19:23 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/a573ace… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.80.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T19:23:15.132872Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:23:23.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.70.0, \u003c 0.80.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:33:20.729Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-rxm9-xp9h-4c84",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-rxm9-xp9h-4c84"
},
{
"name": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.80.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.80.1"
}
],
"source": {
"advisory": "GHSA-rxm9-xp9h-4c84",
"discovery": "UNKNOWN"
},
"title": "Docmost: Page export can include restricted same-space attachments through forged attachmentId"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48073",
"datePublished": "2026-09-24T18:33:20.729Z",
"dateReserved": "2026-05-20T18:25:25.708Z",
"dateUpdated": "2026-09-24T19:23:23.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52853 (GCVE-0-2026-52853)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:31 – Updated: 2026-09-24 18:31
VLAI
EPSS
VEX
Title
Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1.
Severity
5.2 (Medium)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/pull/2250 | x_refsource_MISC |
| https://github.com/docmost/docmost/commit/33895b0… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.90.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.90.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace\u0027s highest privilege level. This issue is fixed in version 0.90.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:31:54.486Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx"
},
{
"name": "https://github.com/docmost/docmost/pull/2250",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/pull/2250"
},
{
"name": "https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.90.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.90.1"
}
],
"source": {
"advisory": "GHSA-84fx-mvqx-p5gx",
"discovery": "UNKNOWN"
},
"title": "Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52853",
"datePublished": "2026-09-24T18:31:54.486Z",
"dateReserved": "2026-06-08T18:41:27.724Z",
"dateUpdated": "2026-09-24T18:31:54.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48072 (GCVE-0-2026-48072)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:30 – Updated: 2026-09-24 18:48
VLAI
EPSS
VEX
Title
Docmost: Public image fileName path traversal leads to unauthorized local file read
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 18:47 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/a573ace… | x_refsource_MISC |
| https://github.com/docmost/docmost/commit/ec83fc8… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.80.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T18:47:04.473169Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:48:38.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.80.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route\u0027s UUID check. This issue is fixed in version 0.80.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:30:57.781Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2"
},
{
"name": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5"
},
{
"name": "https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.80.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.80.1"
}
],
"source": {
"advisory": "GHSA-9f58-29hm-mgp2",
"discovery": "UNKNOWN"
},
"title": "Docmost: Public image fileName path traversal leads to unauthorized local file read"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48072",
"datePublished": "2026-09-24T18:30:57.781Z",
"dateReserved": "2026-05-20T18:25:25.708Z",
"dateUpdated": "2026-09-24T18:48:38.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52850 (GCVE-0-2026-52850)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:30 – Updated: 2026-09-29 03:08
VLAI
EPSS
VEX
Title
Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 03:08 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/830b5b4… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.90.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52850",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T03:08:11.300076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:08:21.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.90.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:30:06.702Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq"
},
{
"name": "https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.90.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.90.1"
}
],
"source": {
"advisory": "GHSA-5vhf-cgf2-c9cq",
"discovery": "UNKNOWN"
},
"title": "Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-52850",
"datePublished": "2026-09-24T18:30:06.702Z",
"dateReserved": "2026-06-08T18:41:27.724Z",
"dateUpdated": "2026-09-29T03:08:21.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65827 (GCVE-0-2026-65827)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:28 – Updated: 2026-09-24 19:22
VLAI
EPSS
VEX
Title
Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service
Summary
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 19:22 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/0411088… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.95.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-65827",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T19:22:03.264160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T19:22:12.940Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.21.0, \u003c 0.95.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:28:36.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-frjw-66gr-799m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-frjw-66gr-799m"
},
{
"name": "https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.95.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.95.0"
}
],
"source": {
"advisory": "GHSA-frjw-66gr-799m",
"discovery": "UNKNOWN"
},
"title": "Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-65827",
"datePublished": "2026-09-24T18:28:36.809Z",
"dateReserved": "2026-07-22T23:16:47.752Z",
"dateUpdated": "2026-09-24T19:22:12.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48070 (GCVE-0-2026-48070)
Vulnerability from cvelistv5 – Published: 2026-09-24 18:15 – Updated: 2026-09-24 18:15
VLAI
EPSS
VEX
Title
Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.
Severity
7.1 (High)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/a573ace… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.80.1 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.80.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T18:15:58.700Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248"
},
{
"name": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.80.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.80.1"
}
],
"source": {
"advisory": "GHSA-95f8-h5hf-8248",
"discovery": "UNKNOWN"
},
"title": "Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48070",
"datePublished": "2026-09-24T18:15:58.700Z",
"dateReserved": "2026-05-20T18:25:25.708Z",
"dateUpdated": "2026-09-24T18:15:58.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40927 (GCVE-0-2026-40927)
Vulnerability from cvelistv5 – Published: 2026-04-21 20:52 – Updated: 2026-04-22 17:42
VLAI
EPSS
VEX
Title
Docmost: XSS in Comments with JavaScript URI
Summary
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-22 17:41 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40927",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T17:41:58.570551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T17:42:15.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.80.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T20:52:29.313Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-4gv6-jw3v-wc34",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-4gv6-jw3v-wc34"
}
],
"source": {
"advisory": "GHSA-4gv6-jw3v-wc34",
"discovery": "UNKNOWN"
},
"title": "Docmost: XSS in Comments with JavaScript URI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40927",
"datePublished": "2026-04-21T20:52:29.313Z",
"dateReserved": "2026-04-15T20:40:15.517Z",
"dateUpdated": "2026-04-22T17:42:15.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34213 (GCVE-0-2026-34213)
Vulnerability from cvelistv5 – Published: 2026-04-14 21:49 – Updated: 2026-04-15 13:31
VLAI
EPSS
VEX
Title
Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation
Summary
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 13:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T13:31:11.461730Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T13:31:17.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.0, \u003c 0.71.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page\u0027s attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:49:55.380Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-89fp-2hch-j9gp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-89fp-2hch-j9gp"
}
],
"source": {
"advisory": "GHSA-89fp-2hch-j9gp",
"discovery": "UNKNOWN"
},
"title": "Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34213",
"datePublished": "2026-04-14T21:49:55.380Z",
"dateReserved": "2026-03-26T15:57:52.324Z",
"dateUpdated": "2026-04-15T13:31:17.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-34212 (GCVE-0-2026-34212)
Vulnerability from cvelistv5 – Published: 2026-04-14 21:42 – Updated: 2026-04-15 20:02
VLAI
EPSS
VEX
Title
Docmost page content has stored XSS via unsanitized attachment URLs
Summary
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 18:56 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-34212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T18:56:22.513458Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T20:02:55.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.71.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:42:44.202Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w"
}
],
"source": {
"advisory": "GHSA-cf68-cff9-hq4w",
"discovery": "UNKNOWN"
},
"title": "Docmost page content has stored XSS via unsanitized attachment URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-34212",
"datePublished": "2026-04-14T21:42:44.202Z",
"dateReserved": "2026-03-26T15:57:52.324Z",
"dateUpdated": "2026-04-15T20:02:55.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33193 (GCVE-0-2026-33193)
Vulnerability from cvelistv5 – Published: 2026-04-14 21:39 – Updated: 2026-04-16 13:51
VLAI
EPSS
VEX
Title
Docmost vulnerable to stored XSS via MIME type spoofing
Summary
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-16 13:51 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33193",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-16T13:51:25.793213Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T13:51:42.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.70.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:39:45.500Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-7cq4-577p-wp6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-7cq4-577p-wp6p"
}
],
"source": {
"advisory": "GHSA-7cq4-577p-wp6p",
"discovery": "UNKNOWN"
},
"title": "Docmost vulnerable to stored XSS via MIME type spoofing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33193",
"datePublished": "2026-04-14T21:39:45.500Z",
"dateReserved": "2026-03-17T22:16:36.721Z",
"dateUpdated": "2026-04-16T13:51:42.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33146 (GCVE-0-2026-33146)
Vulnerability from cvelistv5 – Published: 2026-04-14 21:36 – Updated: 2026-04-15 14:28
VLAI
EPSS
VEX
Title
Docmost's Public Share Search Exposes Metadata of Restricted Children
Summary
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-15 14:27 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-15T14:27:54.646474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-15T14:28:08.044Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.70.0, \u003c 0.70.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:36:53.562Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-qq4c-8rjr-w42c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-qq4c-8rjr-w42c"
}
],
"source": {
"advisory": "GHSA-qq4c-8rjr-w42c",
"discovery": "UNKNOWN"
},
"title": "Docmost\u0027s Public Share Search Exposes Metadata of Restricted Children"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33146",
"datePublished": "2026-04-14T21:36:53.562Z",
"dateReserved": "2026-03-17T21:17:08.884Z",
"dateUpdated": "2026-04-15T14:28:08.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24045 (GCVE-0-2026-24045)
Vulnerability from cvelistv5 – Published: 2026-02-10 16:56 – Updated: 2026-04-14 21:36
VLAI
EPSS
VEX
Title
Docmost Affected by Stored XSS in Public Share Page
Summary
Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.
Severity
7.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 18:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/f3f74c5… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.25.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24045",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-10T18:55:53.971510Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-10T18:55:58.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.20.0, \u003c 0.25.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-14T21:36:07.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq"
},
{
"name": "https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.25.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.25.0"
}
],
"source": {
"advisory": "GHSA-h7fp-4f37-29wq",
"discovery": "UNKNOWN"
},
"title": "Docmost Affected by Stored XSS in Public Share Page"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24045",
"datePublished": "2026-02-10T16:56:37.966Z",
"dateReserved": "2026-01-20T22:30:11.777Z",
"dateUpdated": "2026-04-14T21:36:07.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23630 (GCVE-0-2026-23630)
Vulnerability from cvelistv5 – Published: 2026-01-21 22:51 – Updated: 2026-01-22 16:49
VLAI
EPSS
VEX
Title
Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering
Summary
Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-22 15:09 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/commit/cb9f27d… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.24.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23630",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-22T15:09:16.399808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-22T16:49:01.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.0, \u003c 0.24.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams using mermaid.render(), then inject the returned SVG/HTML into the DOM via dangerouslySetInnerHTML without sanitization. Mermaid per-diagram %%{init}%% directives allow overriding securityLevel and enabling htmlLabels, permitting arbitrary HTML/JS execution for any viewer. This issue has been fixed in version 0.24.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T22:51:27.158Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-r4hj-mc62-jmwj"
},
{
"name": "https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427daf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/cb9f27da9a8b4940760e37e5238a1eb91e427daf"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.24.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.24.0"
}
],
"source": {
"advisory": "GHSA-r4hj-mc62-jmwj",
"discovery": "UNKNOWN"
},
"title": "Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-23630",
"datePublished": "2026-01-21T22:51:27.158Z",
"dateReserved": "2026-01-14T16:08:37.482Z",
"dateUpdated": "2026-01-22T16:49:01.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22249 (GCVE-0-2026-22249)
Vulnerability from cvelistv5 – Published: 2026-01-15 18:43 – Updated: 2026-01-15 19:08
VLAI
EPSS
VEX
Title
Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)
Summary
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-15 19:08 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost/security/advis… | x_refsource_CONFIRM |
| https://github.com/docmost/docmost/pull/1753 | x_refsource_MISC |
| https://github.com/docmost/docmost/commit/c3b350d… | x_refsource_MISC |
| https://github.com/docmost/docmost/releases/tag/v0.24.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22249",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-15T19:08:23.115194Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T19:08:26.158Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "docmost",
"vendor": "docmost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.24.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-15T18:43:56.263Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg"
},
{
"name": "https://github.com/docmost/docmost/pull/1753",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/pull/1753"
},
{
"name": "https://github.com/docmost/docmost/commit/c3b350d943108552e20654580005cd6f6c78ab05",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/commit/c3b350d943108552e20654580005cd6f6c78ab05"
},
{
"name": "https://github.com/docmost/docmost/releases/tag/v0.24.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/docmost/docmost/releases/tag/v0.24.0"
}
],
"source": {
"advisory": "GHSA-54pm-hqxm-54wg",
"discovery": "UNKNOWN"
},
"title": "Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22249",
"datePublished": "2026-01-15T18:43:56.263Z",
"dateReserved": "2026-01-07T05:19:12.921Z",
"dateUpdated": "2026-01-15T19:08:26.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-55574 (GCVE-0-2025-55574)
Vulnerability from cvelistv5 – Published: 2025-08-25 00:00 – Updated: 2025-08-25 16:03
VLAI
EPSS
VEX
Summary
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-25 16:02 UTC
CWE
- n/a
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docmost/docmost |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-55574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-25T16:02:34.790963Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-25T16:03:37.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-25T15:47:47.587Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/docmost/docmost"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-55574",
"datePublished": "2025-08-25T00:00:00.000Z",
"dateReserved": "2025-08-13T00:00:00.000Z",
"dateUpdated": "2025-08-25T16:03:37.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}