Docmost vulnerabilities
We track 2 vulnerabilities in Docmost products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 24, 2026.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest Docmost vulnerabilities
- 7.1 High severity
docmost: Improper Limitation of a Pathname to a Restricted Directory
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage dep
- 9.8 Critical severity
docmost: Improper Limitation of a Pathname to a Restricted Directory
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no vali