Docmost vulnerabilities

Products

• Docmost 15

Newest

• docmost Docmost: Page export can include restricted same-space attachments through forged attachmentId CVE-2026-48073 4.3 MediumSeptember 24, 2026
• docmost Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER CVE-2026-52853 5.2 MediumSeptember 24, 2026
• docmost Docmost: Public image fileName path traversal leads to unauthorized local file read CVE-2026-48072 5.3 MediumSeptember 24, 2026
• docmost Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces CVE-2026-52850 4.3 MediumSeptember 24, 2026
• docmost Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service CVE-2026-65827 6.5 MediumSeptember 24, 2026
• docmost Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion CVE-2026-48070 7.1 HighSeptember 24, 2026
• docmost Docmost: XSS in Comments with JavaScript URI CVE-2026-40927 5.4 MediumApril 21, 2026
• docmost Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation CVE-2026-34213 Public exploit 5.4 MediumApril 14, 2026
• docmost Docmost page content has stored XSS via unsanitized attachment URLs CVE-2026-34212 Public exploit 5.4 MediumApril 14, 2026
• docmost Docmost vulnerable to stored XSS via MIME type spoofing CVE-2026-33193 4.6 MediumApril 14, 2026
• docmost Docmost's Public Share Search Exposes Metadata of Restricted Children CVE-2026-33146 Public exploit 4.3 MediumApril 14, 2026
• docmost Docmost Affected by Stored XSS in Public Share Page CVE-2026-24045 7.3 HighFebruary 10, 2026
• docmost Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering CVE-2026-23630 6.3 MediumJanuary 21, 2026
• docmost Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip) CVE-2026-22249 7.1 HighJanuary 15, 2026
• docmost Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute... CVE-2025-55574 6.1 MediumAugust 25, 2025