149 matches found
PT-2026-98217
Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description Authenticated users can store malicious avatarUrl values that are subsequently processed by the avatar cleanup mechanism. On local-storage deployments, this process lacks proper directory confinemen...
CVE-2026-52853: Improper Privilege Management
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...
CVE-2026-48072: Improper Limitation of a Pathname to a Restricted Directory
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...
PT-2026-98237
Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description The public avatar and logo image endpoint allows an unauthenticated attacker to provide controlled fileName path segments. Because these segments are resolved against local storage without being...
PT-2026-98240
Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace ADMIN can exploit the workspace invitation flow to invite an external email address and assign it the OWNER role. This occurs because the role ceiling does not prevent ADM...
PT-2026-98244
Name of the Vulnerable Software and Affected Versions Docmost versions 0.21.0 through 0.94.0 Description An issue exists in the page-import feature where the ZIP extraction routine fails to limit the total uncompressed size, per-entry size, or entry count of uploaded archives. An authenticated...
PT-2026-98238
Name of the Vulnerable Software and Affected Versions Docmost versions 0.70.0 through 0.80.0 Description An authenticated user with low privileges who can edit an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the page is exported using...
CVE-2026-65827: Uncontrolled Resource Consumption
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...
CVE-2026-48070: Improper Limitation of a Pathname to a Restricted Directory
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can...
CVE-2026-52850: Authorization Bypass Through User-Controlled Key
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce...
PT-2026-98239
Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace member who is not a member of a private space can access confidential content and source page metadata. This occurs because the transclusion / sync-block lookup API does n...
EUVD-2025-210887
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...
CVE-2025-57231
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...
CVE-2025-57231
Docmost versions 0.2.1 through 0.21.0 are vulnerable to a path traversal flaw caused by improper handling of avatar attachments. An unauthenticated attacker can exploit the /api/attachments/img/avatar endpoint via a POST request on a public URL by using %2F sequences to bypass path validation. Th...
PT-2026-89646
Name of the Vulnerable Software and Affected Versions Docmost versions 0.2.1 through 0.21.0 Description An unauthenticated actor can disclose local files through a path traversal issue caused by improper handling of avatar attachments. This is achieved by sending a POST request to a public URL...
CVE-2025-57231
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...
CVE-2025-57231
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...
CVE-2025-57231: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...
