CVE-2026-48072

Docmost , an open-source collaborative wiki and documentation software, is vulnerable to a path traversal flaw in versions prior to 0.80.1 . The public avatar and logo image endpoints fail to confine file path segments to the intended directory, allowing an unauthenticated attacker to traverse ou...

CVE-2026-48072 Docmost: Public image fileName path traversal leads to unauthorized local file read

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

CVE-2025-11945 toeverything AFFiNE Avatar Upload Image Endpoint cross site scripting

A vulnerability was identified in toeverything AFFiNE up to 0.24.1. This vulnerability affects unknown code of the component Avatar Upload Image Endpoint. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. The...

CVE-2025-11945

AFFiNE (toeverything) up to version 0.24.1 contains a cross-site scripting flaw in the Avatar Upload Image Endpoint due to manipulation of unknown code paths. The issue can be exploited remotely and a public exploit exists; vendor did not respond to disclosure. No remediation details are provided...