Vulnerabilities

TI-2026-35514 CVE-2026-48073

Docmost: Page export can include restricted same-space attachments through forged attachmentId

LOW 19

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-09-24 Fixed in 0.80.1 CWE-639

TI-2026-37958 CVE-2026-52853

Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

LOW 23

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 5.2 Network High privileges User interaction EPSS 0.00207 Published 2026-09-24 Fixed in 0.90.1 CWE-269

TI-2026-35513 CVE-2026-48072

Docmost: Public image fileName path traversal leads to unauthorized local file read

LOW 30

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00326 Published 2026-09-24 Fixed in 0.80.1 CWE-22

TI-2026-37955 CVE-2026-52850

Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces

LOW 19

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-09-24 Fixed in 0.90.1 CWE-639

TI-2026-46906 CVE-2026-65827

Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service

LOW 29

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00295 Published 2026-09-24 Fixed in 0.95.0 CWE-400

TI-2026-35511 CVE-2026-48070

Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion

LOW 31

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00369 Published 2026-09-24 Fixed in 0.80.1 CWE-22

TI-2026-29581 CVE-2026-40927

Docmost: XSS in Comments with JavaScript URI

LOW 23

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00139 Published 2026-04-21 Fixed in 0.80.0 CWE-79

TI-2026-26508 CVE-2026-34213

Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation

LOW 24

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00233 Published 2026-04-14 Fixed in 0.71.0 CWE-639

TI-2026-26507 CVE-2026-34212

Docmost page content has stored XSS via unsanitized attachment URLs

LOW 24

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00208 Published 2026-04-14 Fixed in 0.71.0 CWE-79

TI-2026-25618 CVE-2026-33193

Docmost vulnerable to stored XSS via MIME type spoofing

LOW 20

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00187 Published 2026-04-14 Fixed in 0.70.0 CWE-79

TI-2026-25576 CVE-2026-33146

Docmost's Public Share Search Exposes Metadata of Restricted Children

LOW 20

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00275 Published 2026-04-14 Fixed in 0.70.3 CWE-285

TI-2026-19373 CVE-2026-24045

Docmost Affected by Stored XSS in Public Share Page

HIGH 67

Docmost is open-source collaborative wiki and documentation software.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00273 Published 2026-02-10 Fixed in 0.25.0 CWE-79

TI-2026-19029 CVE-2026-23630

Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering

LOW 28

Docmost is open-source collaborative wiki and documentation software.

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00292 Published 2026-01-21 Fixed in 0.24.0 CWE-116

TI-2026-17859 CVE-2026-22249

Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)

HIGH 75

Docmost is an open-source collaborative wiki and documentation software.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00557 Published 2026-01-15 Fixed in 0.24.0 CWE-22

TI-2025-35043 CVE-2025-55574 · GHSA-55v6-3g97-7rjq

Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code

LOW 35

Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00284 Published 2025-08-25 No fix listed CWE-79

Vulnerabilities

Filters