Executive brief
Docmost is a self-hosted document collaboration platform similar to Notion. An unauthenticated attacker can exploit a path traversal vulnerability in the avatar upload endpoint to read arbitrary files from the server, including sensitive configuration files and environment variables containing API keys and authentication tokens. This allows attackers to forge authentication cookies and escalate privileges without needing legitimate access credentials.
Technical details
The vulnerability is a path traversal (directory traversal) flaw in the avatar attachment endpoint of Docmost. The attachment controller fails to properly sanitize or validate file paths in the avatar upload handler, allowing attackers to inject `../` sequences (URL-encoded as `%2F`) to traverse the filesystem. An unauthenticated attacker can send a POST request to the public avatar endpoint with a crafted filename parameter containing path traversal sequences to read arbitrary files such as `/etc/passwd` or `/proc/self/environ`. The `/proc/self/environ` file exposure is particularly critical as it may contain JWT secrets, enabling attackers to forge valid authentication tokens and escalate privileges. The vulnerability affects versions from v0.2.1 through v0.21.0, and was patched in v0.22.0 released on July 29, 2025.
Affected products
- Docmost Docmost v0.2.1 through v0.21.0
Timeline
- 2025-07-28: disclosed: CVE discovered and reported to MITRE
- 2025-07-28: other: Vulnerability reported to vendor
- 2025-07-29: patched: Fix applied in v0.22.0
- 2026-09-10: advisory: CVE-2025-57231 published