Is CVE-2025-57231 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-57231 being exploited in the wild.

How severe is CVE-2025-57231?

High severity, with a CVSS score of 7.5, published 10 September 2026.

Which products and versions are affected?

Docmost v0.2.1 through v0.21.0.

Is there a fix for CVE-2025-57231?

A patch was published on 2025-07-29: Fix applied in v0.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-57231 attacked?

It is attacked over the network.

Am I affected by CVE-2025-57231?

Check whether you run Docmost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-57231: Docmost path traversal in avatar attachments

CVE-2025-57231 · Severity: high · CVSS 7.5 · Published 2026-09-10

Docmost is a self-hosted document collaboration platform similar to Notion. An unauthenticated attacker can exploit a path traversal vulnerability in the avatar upload endpoint to read arbitrary files from the server, including sensitive configuration files and environment variables containing API keys and authentication tokens. This allows attackers to forge authentication cookies and escalate privileges without needing legitimate access credentials.

Technologies: Docmost. Vendors: Docmost.

Quick answers

Is CVE-2025-57231 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-57231 being exploited in the wild.
How severe is CVE-2025-57231?: High severity, with a CVSS score of 7.5, published 10 September 2026.
Which products and versions are affected?: Docmost v0.2.1 through v0.21.0.
Is there a fix for CVE-2025-57231?: A patch was published on 2025-07-29: Fix applied in v0.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-57231 attacked?: It is attacked over the network.
Am I affected by CVE-2025-57231?: Check whether you run Docmost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal (directory traversal) flaw in the avatar attachment endpoint of Docmost. The attachment controller fails to properly sanitize or validate file paths in the avatar upload handler, allowing attackers to inject `../` sequences (URL-encoded as `%2F`) to traverse the filesystem. An unauthenticated attacker can send a POST request to the public avatar endpoint with a crafted filename parameter containing path traversal sequences to read arbitrary files such as `/etc/passwd` or `/proc/self/environ`. The `/proc/self/environ` file exposure is particularly critical as it may contain JWT secrets, enabling attackers to forge valid authentication tokens and escalate privileges. The vulnerability affects versions from v0.2.1 through v0.21.0, and was patched in v0.22.0 released on July 29, 2025.

Affected products

Docmost Docmost v0.2.1 through v0.21.0

Timeline

2025-07-28: disclosed: CVE discovered and reported to MITRE
2025-07-28: other: Vulnerability reported to vendor
2025-07-29: patched: Fix applied in v0.22.0
2026-09-10: advisory: CVE-2025-57231 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.