Skip to content
OpenAdvisories
Medium · 5.4 Public exploit CVE-2026-34212 EUVD-2026-22754

Docmost page content has stored XSS via unsanitized attachment URLs

Published Apr 14, 2026 · Updated Apr 15, 2026 · Assigned by GitHub_M

Vendor: docmost Product: docmost

Description

Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.

Affected products

VendorProductAffectedFixed
docmost docmost < 0.71.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 0xmrma/CVE-2026-34212 ★ 0 · Jun 26, 2026

    Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References