Docmost

Docmost

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2026-34213

  • EPSS 0.04%
  • Veröffentlicht 14.04.2026 21:49:55
  • Zuletzt bearbeitet 17.04.2026 15:38:09

Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within th...

5.4

CVE-2026-34212

  • EPSS 0.03%
  • Veröffentlicht 14.04.2026 21:42:44
  • Zuletzt bearbeitet 17.04.2026 15:38:09

Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attac...

4.6

CVE-2026-33193

  • EPSS 0.03%
  • Veröffentlicht 14.04.2026 21:39:45
  • Zuletzt bearbeitet 17.04.2026 15:38:09

Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this...

4.3

CVE-2026-33146

  • EPSS 0.04%
  • Veröffentlicht 14.04.2026 21:36:53
  • Zuletzt bearbeitet 17.04.2026 15:38:09

Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search...

5.4

CVE-2026-24045

Exploit
  • EPSS 0.04%
  • Veröffentlicht 10.02.2026 16:56:37
  • Zuletzt bearbeitet 14.04.2026 22:16:29

Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This...

5.4

CVE-2026-23630

Exploit
  • EPSS 0.05%
  • Veröffentlicht 21.01.2026 22:51:27
  • Zuletzt bearbeitet 17.02.2026 16:50:10

Docmost is open-source collaborative wiki and documentation software. In versions 0.3.0 through 0.23.2, Mermaid code block rendering is vulnerable to stored Cross-Site Scripting (XSS). The frontend can render attacker-controlled Mermaid diagrams usin...

9.8

CVE-2026-22249

Exploit
  • EPSS 0.03%
  • Veröffentlicht 15.01.2026 18:43:56
  • Zuletzt bearbeitet 22.01.2026 15:44:51

Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there a...

6.1

CVE-2025-55574

  • EPSS 0.04%
  • Veröffentlicht 25.08.2025 00:00:00
  • Zuletzt bearbeitet 15.09.2025 19:44:23

Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code