EUVD-2026-86345Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySubmit profile update with malicious avatarUrl
-
ExploitTraversal value stored unvalidated
-
ExecutionAvatar cleanup resolves path outside directory
-
ImpactService account deletes arbitrary files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) a valid authenticated low-privileged Docmost account (PR:L), and (2) a deployment configured with LOCAL STORAGE for attachments/avatars - object-storage (e.g. S3) deployments are not affected as stated by the advisory. The attacker sets an attacker-controlled avatarUrl that is stored without confinement to the intended directory and later consumed by the avatar cleanup routine, which deletes files/directories reachable by the Docmost service account. Limiting factors: authentication is mandatory (no anonymous exploitation), impact is bounded to files accessible by the service account, and the destructive action depends on the cleanup routine executing against the stored value. Affects versions prior to 0.80.1. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 7.1) describes a network-reachable, low-complexity flaw exploitable by any authenticated low-privileged user with no user interaction, yielding high integrity impact (arbitrary file/directory deletion) and low availability impact, no confidentiality loss. No EPSS score, KEV listing, POC, or SSVC decision data were provided, so exploitation status is: no public exploit identified at time of analysis. This is a credible but not top-tier priority: the high-integrity destructive impact is real, yet exploitation is gated behind two conditions the raw score partially obscures - the attacker must already hold a valid low-privilege account, and the deployment must use local-storage (not S3/object storage) for attachments. There is no signal (EPSS/KEV/POC) suggesting active or widespread exploitation, so risk is largely theoretical pending patching; the source-code fix is confirmed in the commit diff, which strengthens confidence that the flaw is genuine rather than speculative. |
| Exploit ScenarioDerived | A low-privileged authenticated Docmost user on a local-storage deployment updates their profile and sets an avatarUrl containing directory-traversal sequences pointing outside the intended avatar directory. When the avatar-cleanup routine later reuses that stored value, it deletes the referenced arbitrary file or directory owned by the Docmost service account. No public exploit code was identified, but the vulnerable code path and fix are visible in the referenced commit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Arbitrary local file and directory deletion on Docmost deployments that use local storage, exploitable by any authenticated low-privileged user. An attacker stores a crafted avatarUrl value that is not confined to the intended avatar directory; when Docmost's avatar cleanup routine later consumes that stored value, it deletes files or directories reachable by the Docmost service account. The issue affects Docmost versions prior to 0.80.1 and is rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) - high integrity impact, low availability impact, no confidentiality loss. There is no public exploit code identified at time of analysis, and exploitation requires a valid account, so risk is concentrated in multi-tenant or shared instances running local storage.
RemediationAI
Vendor-released patch: upgrade to Docmost 0.80.1, which removes the writable avatarUrl and logo fields, sanitizes file names in the attachment controller, and hardens attachment resolution during export; see the advisory at https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248, the fix commit at https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5, and the release notes at https://github.com/docmost/docmost/releases/tag/v0.80.1. If upgrading immediately is not possible, the most effective compensating control is to migrate attachment and avatar storage from local disk to an object-storage backend such as S3, since object-storage deployments are not affected - the trade-off is migration effort and any data-transfer or hosting cost, and the stored path string becomes inert rather than traversable. Where local storage must remain, run the Docmost service account as an unprivileged user with the narrowest possible filesystem scope, so that even a successful traversal cannot reach configuration files, application source, or other tenants' data; this does not prevent the deletion but bounds its blast radius. Containers should mount the data directory (and only that directory) from a dedicated volume and keep the rest of the filesystem read-only, which blocks cleanup from deleting anything outside the volume at the cost of some operational flexibility. Because exploitation requires only a valid low-privileged account (PR:L), reduce the attack surface by tightening account provisioning and removing unused or guest accounts until the upgrade is complete; note that this is a governance control, not a technical fix, and does not stop an existing legitimate low-privileged user.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a path traversal (CWE-22) class flaw in how Docmost persists and later reuses user-supplied path-like fields. In the vulnerable versions, the user update DTO accepted an arbitrary avatarUrl string (and the workspace DTO accepted a logo string), which the user service wrote directly onto the user record with no validation or confinement to the avatar directory. Cleanup logic then reused that stored value as a filesystem path on local-storage deployments, following ../ sequences outside the intended directory and resolving them against whatever the Docmost service account can reach. The stack is a NestJS/Fastify server (Fastify static and multipart plugins handle file serving and uploads) with an S3-or-local storage abstraction, which is why only local-storage deployments are exposed - object-storage backends never turn the stored string into a filesystem path. The upstream fix reflects this: it removes avatarUrl and logo from the writable DTOs and user service, adds a sanitize check from sanitize-filename-ts in the attachment controller to reject file names whose sanitized form differs from the input, and reworks the export service to resolve accessible attachments once, batched per export, with an owning-page view check rather than trusting raw attachment ids. Together these changes close both the injection point (attacker-controlled path string) and the deletion sink (unconfined path reuse).
Know when Docmost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Any authenticated low-priv user (PR:L) can remotely trigger deletion with no interaction; arbitrary file deletion is I:H, incidental service disruption A:L, no data disclosure C:N; local-storage requirement is common enough to keep AC:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.
Technical POC Analysis
Evidence basis: this breakdown is reconstructed from advisory GHSA-95f8-h5hf-8248 only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Docmost deployments using local storage and running versions prior to 0.80.1 are exposed to an authenticated low-privileged user who can delete arbitrary files and directories reachable by the Docmost service account. This poses a high integrity risk for multi-tenant or shared instances, where a single malicious account could disrupt other tenants or corrupt shared data, though confidentiality is unaffected and no public exploit identified at time of analysis. Leadership should prioritize remediation because no vendor-released patch identified at time of analysis and the attack requires only a valid account.
No vendor-released patch identified at time of analysis. Restrict the Docmost service account to least-privilege filesystem permissions, isolate local storage from other critical data, disable avatar uploads or switch to object storage if feasible, enforce strong authentication, and monitor for unexpected file deletion events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Unauthenticated path traversal in Docmost v0.21.0's avatar attachment endpoint allows remote attackers to read arbitrary
Stored XSS in Docmost before version 0.25.0 allows authenticated attackers to inject malicious scripts into public share
Docmost versions 0.21.0 through 0.23.x contain a path traversal vulnerability in the zip import feature that allows auth
Stored XSS in Docmost 0.3.0-0.23.2 allows authenticated users to execute arbitrary JavaScript in the browsers of documen
Uncontrolled archive extraction in Docmost 0.21.0 through 0.95.0 lets any authenticated workspace member who holds edit
Docmost versions 0.3.0 through 0.70.x allow authenticated users with low privileges to overwrite arbitrary attachments b
Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks t
Stored cross-site scripting (XSS) in Docmost prior to version 0.71.0 allows authenticated users to inject malicious `jav
Unauthenticated path traversal in Docmost versions prior to 0.80.1 allows a remote attacker to read files from local sto
Workspace ADMIN accounts in Docmost prior to 0.90.1 can mint OWNER-level accounts through the workspace invitation flow,
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious
Authenticated workspace members in Docmost prior to 0.90.1 can read confidential sync-block content from private spaces
Exploit-DB