CVE-2026-22249
HighSummary
Docmost, an open-source collaborative wiki and documentation software, versions 0.21.0 through before 0.24.0, is vulnerable to Arbitrary File Write via the Zip Import feature (ZipSlip). The lack of filename validation in file.utils.ts allows an attacker to write files to arbitrary locations on the server.
Risk Assessment
An attacker can exploit this vulnerability to overwrite or create files on the system, potentially leading to server compromise, data modification, or execution of malicious code.
Recommendation
It is recommended to immediately upgrade Docmost to version 0.24.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Docmost
See all- CVE-2026-34213Medium
Docmost is open-source collaborative wiki and documentation software. In versions from 0.3.0 to 0.71.0, improper authorization allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim attachmentId to POST /api/files/upload. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
- CVE-2026-34212Medium
In Docmost prior to 0.71.0, improper neutralization of attachment URLs allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node. When another user views the page and activates the link, attacker-controlled JavaScript executes in the Docmost context.
- CVE-2026-33193Medium
Docmost prior to 0.70.0 is vulnerable to XSS via MIME type spoofing. An attacker can inject malicious script that executes in the victim's browser.
- CVE-2026-33146Medium
Docmost open-source collaborative wiki software, versions 0.70.0 through 0.70.2, has an authorization bypass vulnerability in the public search endpoint, allowing unauthenticated users to enumerate and retrieve hidden child page titles and text snippets.
Original NVD description (English source)
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.