EUVD-2026-22752Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.
AnalysisAI
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious scripts through MIME type spoofing, potentially compromising user sessions and data integrity. The vulnerability requires user interaction (clicking a link or viewing injected content) and affects only the confidentiality and integrity of affected users' data, not availability. Vendor-released patch: version 0.70.0.
Technical ContextAI
Docmost is a collaborative wiki and documentation platform that fails to properly validate MIME type information during content upload or processing. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the root cause is insufficient input sanitization or output encoding when handling file MIME types. Attackers can spoof MIME type headers to bypass server-side validation, allowing injected JavaScript to be stored and executed in the browsers of users who subsequently view the affected content. The vulnerability chain involves file upload handling that trusts user-supplied MIME type values without proper verification or encoding before rendering in the web interface.
RemediationAI
Upgrade Docmost to version 0.70.0 or later immediately. This version contains the vendor-released patch addressing MIME type validation and XSS prevention. If immediate upgrade is not feasible, restrict document upload and editing permissions to trusted users only, and implement Content Security Policy (CSP) headers with strict directives (script-src 'self') to mitigate stored XSS payload execution. Verify the patch by reviewing the security advisory at https://github.com/docmost/docmost/security/advisories/GHSA-7cq4-577p-wp6p and consulting the official release notes. After patching, audit recently modified documents for signs of injected scripts, particularly any uploaded files with mismatched MIME types.
Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary
Stored XSS in Docmost before version 0.25.0 allows authenticated attackers to inject malicious scripts into public share
Docmost versions 0.21.0 through 0.23.x contain a path traversal vulnerability in the zip import feature that allows auth
Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of documen
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments b
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks t
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious `jav
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restri
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code. Rated me
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today