CVE-2026-48070 Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can...

CVE-2026-65827: Uncontrolled Resource Consumption

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-52853: Improper Privilege Management

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52850: Authorization Bypass Through User-Controlled Key

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...

CVE-2026-48073: Authorization Bypass Through User-Controlled Key

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-48072: Improper Limitation of a Pathname to a Restricted Directory

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

CVE-2026-48070: Improper Limitation of a Pathname to a Restricted Directory

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can...

PT-2026-98217

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description Authenticated users can store malicious avatarUrl values that are subsequently processed by the avatar cleanup mechanism. On local-storage deployments, this process lacks proper directory confinemen...

PT-2026-98240

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace ADMIN can exploit the workspace invitation flow to invite an external email address and assign it the OWNER role. This occurs because the role ceiling does not prevent ADM...

PT-2026-98238

Name of the Vulnerable Software and Affected Versions Docmost versions 0.70.0 through 0.80.0 Description An authenticated user with low privileges who can edit an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the page is exported using...

PT-2026-98244

Name of the Vulnerable Software and Affected Versions Docmost versions 0.21.0 through 0.94.0 Description An issue exists in the page-import feature where the ZIP extraction routine fails to limit the total uncompressed size, per-entry size, or entry count of uploaded archives. An authenticated...

PT-2026-98237

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description The public avatar and logo image endpoint allows an unauthenticated attacker to provide controlled fileName path segments. Because these segments are resolved against local storage without being...

PT-2026-98239

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace member who is not a member of a private space can access confidential content and source page metadata. This occurs because the transclusion / sync-block lookup API does n...

EUVD-2025-210887

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

CVE-2025-57231

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

PT-2026-89646

Name of the Vulnerable Software and Affected Versions Docmost versions 0.2.1 through 0.21.0 Description An unauthenticated actor can disclose local files through a path traversal issue caused by improper handling of avatar attachments. This is achieved by sending a POST request to a public URL...

CVE-2025-57231: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

CVE-2025-57231

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

CVE-2025-57231

Docmost versions 0.2.1 through 0.21.0 are vulnerable to a path traversal flaw caused by improper handling of avatar attachments. An unauthenticated attacker can exploit the /api/attachments/img/avatar endpoint via a POST request on a public URL by using %2F sequences to bypass path validation. Th...

CVE-2025-57231

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...