Ddocmost

Products

Exploited and recent CVEs

• CVE-2026-48073 Medium 4.3 Docmost: Page export can include restricted same-space attachments through forged attachmentId 0.2%
• CVE-2026-52853 Medium 5.2 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER 0.2%
• CVE-2026-48072 Medium 5.3 Docmost: Public image fileName path traversal leads to unauthorized local file read 0.3%
• CVE-2026-52850 Medium 4.3 Docmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces 0.2%
• CVE-2026-65827 Medium 6.5 Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service 0.3%
• CVE-2026-48070 High 7.1 Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion 0.4%
• CVE-2026-40927 Medium 5.4 Docmost: XSS in Comments with JavaScript URI 0.1%
• CVE-2026-34213 Medium 5.4 Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation 0.2%
• CVE-2026-34212 Medium 5.4 Docmost page content has stored XSS via unsanitized attachment URLs 0.2%
• CVE-2026-33193 Medium 4.6 Docmost vulnerable to stored XSS via MIME type spoofing 0.2%
• CVE-2026-33146 Medium 4.3 Docmost's Public Share Search Exposes Metadata of Restricted Children 0.3%
• CVE-2026-24045 High 7.3 Docmost Affected by Stored XSS in Public Share Page 0.3%
• CVE-2026-23630 Medium 6.3 Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering 0.3%
• CVE-2026-22249 High 7.1 Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip) 0.6%