EUVD-2026-24487Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated commenter required (PR:L), victim must click link (UI:R), XSS crosses into victim session scope (S:C); no availability impact applies.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.
AnalysisAI
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks that execute arbitrary JavaScript when victims click them. All Docmost instances prior to version 0.80.0 are affected (CPE: cpe:2.3:a:docmost:docmost:*). No active exploitation has been confirmed - SSVC exploitation status is 'none' and the vulnerability is absent from CISA KEV - and EPSS at 0.03% (8th percentile) indicates minimal real-world exploitation probability. Vendor-released patch is available in version 0.80.0.
Technical ContextAI
Docmost is an open-source collaborative wiki and documentation platform. The flaw is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting): when a user inserts a hyperlink into a comment, Docmost fails to validate or sanitize the URL scheme, permitting the javascript: URI to pass through to rendered HTML. When a victim user clicks the link, the browser executes the embedded JavaScript within Docmost's origin context, inheriting that origin's session cookies and storage. The CVSS S:C (Changed Scope) metric confirms the payload crosses trust boundaries from the comment author's context to the victim's active session, a defining characteristic of stored XSS exploited via user-clickable links.
RemediationAI
Upgrade Docmost to version 0.80.0 or later, the vendor-confirmed fixed release per advisory GHSA-4gv6-jw3v-wc34 at https://github.com/docmost/docmost/security/advisories/GHSA-4gv6-jw3v-wc34. If immediate upgrade is not feasible, restrict commenting permissions to only explicitly trusted and authenticated users, reducing the pool of potential attackers - note this trades collaboration functionality for security posture. Deploying a Content Security Policy (CSP) header that includes 'script-src' without 'unsafe-inline' and explicitly blocks javascript: URI navigation (via 'default-src' or 'navigate-to' directives) can mitigate execution of injected payloads in modern browsers; however, CSP effectiveness depends on correct web server or reverse-proxy configuration and requires testing against Docmost's frontend to avoid breaking legitimate functionality.
Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary
Stored XSS in Docmost before version 0.25.0 allows authenticated attackers to inject malicious scripts into public share
Docmost versions 0.21.0 through 0.23.x contain a path traversal vulnerability in the zip import feature that allows auth
Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of documen
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments b
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious `jav
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restri
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code. Rated me
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today