CVE-2026-48072 Details
Description
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.
A path traversal vulnerability has been identified in Docmost, an open-source collaborative wiki and documentation software, prior to version 0.80.1. The issue arises in the public avatar and logo image endpoint, which accepts fileName path segments controlled by attackers. These segments are resolved against local storage without proper confinement to the designated image directory. As a result, an unauthenticated attacker can traverse outside the intended directories and read local storage objects whose final basename meets the route's UUID criteria. This vulnerability is present in version 0.80.0 and earlier.
Users can upgrade to Docmost version 0.80.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5 | [email protected] | Source CodeVendor |
| https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97 | [email protected] | Source CodeVendor |
| https://github.com/docmost/docmost/releases/tag/v0.80.1 | [email protected] | Release NotesVendor |
| https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Docmost | 0.80.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |
| Sep 24, 2026 | CVE Modified | CISA-ADP |