EUVD-2026-22754Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
6DescriptionCVE.org
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious javascript: URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
AnalysisAI
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious javascript: URLs into attachment nodes, executing arbitrary JavaScript in the browser context of other users who activate those attachments. Attack requires low privileges and user interaction (clicking the attachment), affecting all users viewing compromised pages. The vulnerability has been patched in version 0.71.0.
Technical ContextAI
Docmost is a collaborative wiki and documentation platform that stores attachment metadata within page content nodes. The vulnerability stems from improper neutralization of URL schemes in attachment link handlers (CWE-79: Improper Neutralization of Input During Web Page Generation). When rendering attachment nodes, the application fails to sanitize or validate the URL protocol, permitting javascript: scheme injection. This allows an authenticated user to craft a malicious attachment object containing a javascript: URL. When another user interacts with the attachment link/icon in their browser, the JavaScript context executes with full access to the Docmost origin-enabling session hijacking, credential theft, or defacement within the scope of the compromised user's permissions.
RemediationAI
Upgrade Docmost to version 0.71.0 or later, which patches the URL neutralization flaw. Users unable to upgrade immediately should restrict attachment creation and editing to trusted administrators, review existing attachments for malicious URL schemes (search for javascript: in attachment metadata), and educate users not to click suspicious attachment links. Apply the fix via your deployment method (Docker, source build, package manager) and restart the Docmost service. See https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w for the official advisory.
Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary
Stored XSS in Docmost before version 0.25.0 allows authenticated attackers to inject malicious scripts into public share
Docmost versions 0.21.0 through 0.23.x contain a path traversal vulnerability in the zip import feature that allows auth
Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of documen
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments b
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks t
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restri
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code. Rated me
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today