Docmost EUVD-2026-86386

Requires an authenticated workspace member who holds edit rights to at least one space (PR:L) - anonymous/unauthenticated exploitation is not possible. The attacker must reach the page-import feature and upload an archive; the archive must include exactly one nested ZIP, because the extractor auto-extracts a single nested level and applies no size/entry limits. Affected deployments run Docmost 0.21.0 through versions before 0.95.0. The outer upload must fit within the default 200 MB import limit (adjustable by operators). No user interaction by a victim is needed (UI:N). The most severe (cross-tenant) impact applies specifically to multi-tenant/shared instances; a single-tenant self-hosted install only affects itself.

This is a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: network-reachable, low complexity, requires low privileges (an authenticated workspace member with edit rights to a space), no user interaction, and pure availability impact - no confidentiality or integrity loss. The 6.5 score is a MEDIUM, not a critical, and correctly reflects that exploitation needs valid credentials plus edit rights, not anonymous access. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided intelligence, so there is no evidence of active exploitation or automated weaponization; risk is theoretical-but-plausible rather than urgent. No SSVC decision data was supplied. The one signal that could argue for slightly higher priority is the multi-tenant blast radius: the description says disk exhaustion 'degrades or takes down the instance for all tenants,' meaning a single low-privileged tenant can affect co-tenants - an argument for S:C (scope change) that the vendor did not take. Overall: a real, patch-worthy DoS in a shared-hosting/SaaS context, low-to-moderate priority for single-tenant self-hosters.

An attacker who is (or who compromises) a workspace member with edit rights to any space uploads a specially crafted nested ZIP to the page-import feature. The outer archive stays under the default 200 MB upload limit but its single nested ZIP decompresses to multiple gigabytes; because the extractor caps neither total uncompressed size, per-entry size, nor entry count, extraction to the server temp directory exhausts disk, crashing the import worker and degrading the instance for all tenants. No public exploit code is identified at time of analysis, though the technique (a classic zip bomb) is well understood.