CVE-2026-22249

Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)

7.1 High

CVE-2026-22249 is a high vulnerability (CVSS 7.1) in Docmost, published January 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. No source names a fixed version.

Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: High

Exploit likelihood

0.56%Up 0.5 points since Jan 16, 2026

What each source reports

CVE List Score used 7.1

Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)

Record: CVE-2026-22249
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2026-2856 7.1

Record: EUVD-2026-2856
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-22249
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSV 7.1