What is the CVSS score of CVE-2025-57231?

CVE-2025-57231 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Docmost are affected by CVE-2025-57231?

Docmost v0.21.0 instances exposed to the internet are actively at risk from an unauthenticated path traversal vulnerability in the avatar attachment endpoint, with publicly available technical…

Is there a public PoC exploit available for CVE-2025-57231?

Yes, a public proof-of-concept exploit is available for CVE-2025-57231. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-57231?

Within 24 hours: inventory all Docmost instances in production and identify which are running v0.21.0; immediately restrict network access to the avatar attachment endpoint using a Web Application Firewall or reverse proxy to block path traversal patterns (.., .., encoded variants). Within 7 days: contact Docmost vendor for patch availability and security guidance; review access logs from the past 30 days for suspicious requests to attachment endpoints; rotate credentials for database connections, API keys, and system accounts that may be stored in configuration files. Within 30 days: upgrade all affected Docmost v0.21.0 instances to a patched version once available; conduct a security audit of potentially exposed files and assess whether any sensitive data was accessed without authorization.

Docmost CVE-2025-57231

EUVD-2025-210887 HIGH

Path Traversal (CWE-22)

2026-09-10 mitre

GHSA-59m3-fj8c-996g

Path Traversal Docmost

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Public unauthenticated network endpoint, no complexity or interaction, read-only file disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Threat Model Generated

Sep 14, 2026 - 23:30 vuln.today

POC Analysis Generated

Sep 14, 2026 - 23:20 vuln.today

Metadata Corrected

Sep 11, 2026 - 20:40 vuln.today

tag: Docmost added

Metadata Corrected

Sep 11, 2026 - 20:40 vuln.today

tag: N A removed

Analysis Generated

Sep 11, 2026 - 20:31 vuln.today

CVSS changed

Sep 11, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Sep 10, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Sep 10, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.

AnalysisAI

Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary local files from the server by embedding directory traversal sequences in a POST request to a publicly accessible URL. The flaw exists in the attachment controller (attachment.controller.ts:345) and requires no authentication, making every internet-exposed Docmost v0.21.0 instance vulnerable to local file disclosure. A public advisory with technical details is available from Artresilia; SSVC classifies exploitation as automatable, further elevating practical risk despite a low EPSS of 0.15%.

Technical ContextAI

Docmost is an open-source, self-hosted collaborative documentation and wiki platform. The vulnerability is rooted in CWE-22 (Path Traversal): the avatar attachment upload endpoint exposed as a public POST route fails to canonicalize or sanitize the filename or path parameter supplied by the client, allowing traversal sequences such as '../../../etc/passwd' to escape the intended upload directory. The specific code location is identified by the reporter as apps/server/src/core/attachment/attachment.controller.ts at line 345 in the Docmost GitHub repository at commit 0bd7ecb9b03a74e9a5e3f97b6457b82371c5ceb2. Because the endpoint is designated public (no session or token check before the path is resolved), the traversal is reachable without any credentials. The CPE entry in NVD uses n/a placeholders and does not reflect the real product.

RemediationAI

Check the Docmost GitHub repository and release notes for a version newer than v0.21.0 that addresses this path traversal - no specific patched version is identified in the available input data. Consult the Artresilia advisory at https://www.artresilia.com/docmost-v0-21-0-cve-2025-57231-unauthenticated-file-path-traversal/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-57231 for updates. As an immediate compensating control, block external access to the avatar attachment POST endpoint at the reverse proxy or firewall level, accepting the trade-off that avatar upload functionality will be unavailable to unauthenticated users. Additionally, ensure Docmost runs under a dedicated, least-privilege OS account to limit which files are readable if exploitation occurs. Do not rely solely on EPSS to deprioritize this - the automatable SSVC rating means mass exploitation tooling is straightforward to develop.