Skip to content
OpenAdvisories

Vendor

docmost

14 known vulnerabilities.

Products

docmost 14
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-34213 Public exploit

    Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation

    Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same wo…

    docmost docmost
  • Medium 5.4
    CVE-2026-34212 Public exploit

    Docmost page content has stored XSS via unsanitized attachment URLs

    Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment nod…

    docmost docmost
  • Medium 4.3
    CVE-2026-33146 Public exploit

    Docmost's Public Share Search Exposes Metadata of Restricted Children

    Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-se…

    docmost docmost