{"id":"CVE-2026-48070","aliases":["EUVD-2026-86345","GHSA-95f8-h5hf-8248"],"status":"published","title":"Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion","description":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00369,"percentile":0.31153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-09-24T18:15:58Z","modified":"2026-10-28T02:30:54Z","products":[{"vendor":"docmost","product":"docmost"}],"references":[{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/docmost/docmost/releases/tag/v0.80.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48070.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48070","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-48070","title":"Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion","description":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.","status":"published","published":"2026-09-24T18:15:58.7Z","modified":"2026-10-05T15:32:29.262Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-86345","description":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.","status":"published","published":"2026-09-24T18:15:58Z","modified":"2026-10-05T15:32:29Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T17:27:39.819382Z"}],"nvd":[{"id":"CVE-2026-48070","description":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.","status":"published","published":"2026-09-24T19:17:13.43Z","modified":"2026-10-05T16:17:13.64Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:51.388161Z"}],"osv":[{"id":"CVE-2026-48070","title":"Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion","description":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.","status":"published","published":"2026-09-24T18:15:58.7Z","modified":"2026-10-28T02:30:54.474251105Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:06.701612Z"}]}}