Docmost vulnerabilities

Docmost, an open-source collaborative wiki and documentation software, versions 0.21.0 through before 0.24.0, is vulnerable to Arbitrary File Write via the Zip Import feature (ZipSlip). The lack of filename validation in file.utils.ts allows an attacker to write files to arbitrary locations on the server.

Docmost is open-source collaborative wiki and documentation software. In versions from 0.3.0 to 0.71.0, improper authorization allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim attachmentId to POST /api/files/upload. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.

In Docmost prior to 0.71.0, improper neutralization of attachment URLs allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node. When another user views the page and activates the link, attacker-controlled JavaScript executes in the Docmost context.

Docmost prior to 0.70.0 is vulnerable to XSS via MIME type spoofing. An attacker can inject malicious script that executes in the victim's browser.

Docmost open-source collaborative wiki software, versions 0.70.0 through 0.70.2, has an authorization bypass vulnerability in the public search endpoint, allowing unauthenticated users to enumerate and retrieve hidden child page titles and text snippets.