Arbitrary file upload in Docat Upload API
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Docat from docat-org before 1.6.0 is affected. The Upload API does not validate the uploaded file path or type, which is CWE-434. An attacker with low privileges can overwrite sensitive configuration files or place malicious files on the Docat web server, and depending on the deployment, uploaded content can enable remote code execution or cross-site scripting.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for docat. Version 1.6.0 mitigates filename-based path traversal, but the sources do not establish a fix for unrestricted file types.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA docat (docat-org) Fixed in 1.6.0
Timeline
- 2026-10-29 Threatist record created from CVE-2026-61645
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences