CVE-2026-100682

Budibase Server versions prior to 3.45.0 are vulnerable to an arbitrary file write vulnerability within the PWA icon upload endpoint . The root cause is a lack of proper symlink validation during the extraction of user-supplied ZIP archives. An attacker with the BUILDER role can exploit this by c...

CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in the PWA icon upload endpoint that extracts user-supplied ZIP archives without proper symlink validation. Attackers with BUILDER role can craft a malicious ZIP with leaf symlink entries followed by duplicate file entri...

PT-2026-107350

TuxCare rebuilt adm-zip to address 1 CVE. Fixed in 0.5.18-tuxcare.3...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : ClamAV vulnerabilities (USN-8788-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8788-1 advisory. It was discovered that ClamAV incorrectly handled certain zip archive files. A remote attacker could possibly use this issue to...

CVE-2026-65827

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-48073

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...

EUVD-2026-86392

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-48073 Docmost: Page export can include restricted same-space attachments through forged attachmentId

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

CVE-2026-65827 Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

EUVD-2026-86386

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-65827

The open-source collaborative wiki software Docmost is vulnerable to a denial of service via an unbounded ZIP decompression (zip-bomb) in the page-import feature. In versions 0.21.0 through 0.95.0 , an authenticated workspace member with edit rights can upload an archive that lacks limits on tota...

CVE-2026-65827 Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-65827 Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-65827: Uncontrolled Resource Consumption

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-48073: Authorization Bypass Through User-Controlled Key

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with...

PT-2026-98238

Name of the Vulnerable Software and Affected Versions Docmost versions 0.70.0 through 0.80.0 Description An authenticated user with low privileges who can edit an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the page is exported using...

PT-2026-98244

Name of the Vulnerable Software and Affected Versions Docmost versions 0.21.0 through 0.94.0 Description An issue exists in the page-import feature where the ZIP extraction routine fails to limit the total uncompressed size, per-entry size, or entry count of uploaded archives. An authenticated...