Vulnerability · Published Feb 10, 2026 · Assigned by GitHub_M

CVE-2026-24045Docmost Affected by Stored XSS in Public Share Page

High 7.3

In plain English

A high-severity cross-site scripting in docmost from docmost. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.

Affected products (as reported)

Vendor	Product	Versions
docmost	docmost	>= 0.20.0, < 0.25.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq x_refsource_CONFIRM
https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9 x_refsource_MISC
https://github.com/docmost/docmost/releases/tag/v0.25.0 x_refsource_MISC