Skip to content
OpenAdvisories

Vendor

docmost

14 known vulnerabilities.

Products

docmost 14
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-48070

    Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion

    Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage de…

    docmost docmost
  • High 7.3
    CVE-2026-24045

    Docmost Affected by Stored XSS in Public Share Page

    Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows S…

    docmost docmost
  • High 7.1
    CVE-2026-22249

    Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)

    Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no val…

    docmost docmost