Docmost 0.2.1-0.21.0 - Arbitrary File Read

Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL. id: CVE-2025-57231 info: name: Docmost 0.2.1-0.21.0 - Arbitrary File Read author: anirbala98 severity: high...

CVE-2025-57231

CVE-2025-57231 - Docmost 0.22.0 - Произвольное чтение файлов Этот репозиторий содержит Proof of Concept PoC эксплойт для CVE-2025-57231. Отказ от ответственности Этот проект предоставлен исключительно в образовательных целях и для авторизованного тестирования безопасности. Не используйте его прот...

CVE-2026-34212

CVE-2026-34212 Docmost a accepté une URL de type javascript: dans un nœud de pièce jointe, l’a conservée lors du stockage et du rendu, et l’a transformée en un lien cliquable dans l’origine de Docmost. Introduction J’ai identifié, divulgué de manière responsable et reproduit un problème de stored...

CVE-2026-34213

CVE-2026-34213 Un utilisateur Docmost à faibles privilèges pourrait fournir un attachmentId victime au point de terminaison de téléversement générique et écraser la pièce jointe stockée d'une autre page dans le même espace de travail. Introduction J'ai identifié, divulgué de manière responsable e...

CVE-2026-33146

CVE-2026-33146 Un partage public semblait propre dans l'arborescence des pages, mais le point de terminaison de recherche racontait une histoire différente. Dans Docmost, les pages enfants restreintes, masquées aux visiteurs du partage public, pouvaient tout de même fuiter via les résultats de...

CVE-2026-65827

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-52853

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-48072

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

CVE-2026-48073

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-52850

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

CVE-2026-48070

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

EUVD-2026-86392

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853

The open-source collaborative wiki software Docmost is vulnerable to privilege escalation prior to version 0.90.1 . An authenticated workspace ADMIN can bypass role ceilings within the workspace invitation flow to invite an external email address with OWNER permissions. This flaw allows an ADMIN ...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

EUVD-2026-86391

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...