CVE-2026-65827 Details
Description
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.
A denial-of-service vulnerability has been identified in Docmost versions 0.21.0 prior to 0.95.0. The issue arises from an unbounded ZIP extraction routine in the page-import feature, which allows authenticated workspace members with edit rights to upload archives. The extraction process does not limit the total uncompressed size, per-entry size, or entry count. This flaw enables a small ZIP file to expand into several gigabytes of data, exhausting disk space and crashing the import worker, thereby degrading or disrupting the instance for all tenants.
Users can upgrade to Docmost version 0.95.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7 | [email protected] | Source CodeVendor |
| https://github.com/docmost/docmost/releases/tag/v0.95.0 | [email protected] | Release NotesVendor |
| https://github.com/docmost/docmost/security/advisories/GHSA-frjw-66gr-799m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Docmost | >= 0.21.0, <= 0.95.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |