# CVE-2025-57231: Docmost path traversal in avatar attachments

Source: https://junglewise.ai/threats/cve-2025-57231-docmost-path-traversal-in-avatar-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-57231 · Severity: high · CVSS 7.5 · Published 2026-09-10

Docmost is a self-hosted document collaboration platform similar to Notion. An unauthenticated attacker can exploit a path traversal vulnerability in the avatar upload endpoint to read arbitrary files from the server, including sensitive configuration files and environment variables containing API keys and authentication tokens. This allows attackers to forge authentication cookies and escalate privileges without needing legitimate access credentials.

Technologies: [Docmost](https://junglewise.ai/threats/technologies/docmost). Vendors: [Docmost](https://junglewise.ai/threats/vendors/docmost).

## Quick answers

**Is CVE-2025-57231 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57231 being exploited in the wild.

**How severe is CVE-2025-57231?** High severity, with a CVSS score of 7.5, published 10 September 2026.

**Which products and versions are affected?** Docmost v0.2.1 through v0.21.0.

**Is there a fix for CVE-2025-57231?** A patch was published on 2025-07-29: Fix applied in v0.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-57231 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-57231?** Check whether you run Docmost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal (directory traversal) flaw in the avatar attachment endpoint of Docmost. The attachment controller fails to properly sanitize or validate file paths in the avatar upload handler, allowing attackers to inject `../` sequences (URL-encoded as `%2F`) to traverse the filesystem. An unauthenticated attacker can send a POST request to the public avatar endpoint with a crafted filename parameter containing path traversal sequences to read arbitrary files such as `/etc/passwd` or `/proc/self/environ`. The `/proc/self/environ` file exposure is particularly critical as it may contain JWT secrets, enabling attackers to forge valid authentication tokens and escalate privileges. The vulnerability affects versions from v0.2.1 through v0.21.0, and was patched in v0.22.0 released on July 29, 2025.

## Affected products

- Docmost Docmost v0.2.1 through v0.21.0

## Timeline

- 2025-07-28: disclosed: CVE discovered and reported to MITRE
- 2025-07-28: other: Vulnerability reported to vendor
- 2025-07-29: patched: Fix applied in v0.22.0
- 2026-09-10: advisory: CVE-2025-57231 published

## References

- [https://github.com/docmost/docmost/blob/0bd7ecb9b03a74e9a5e3f97b6457b82371c5ceb2/apps/server/src/core/attachment/attachment.controller.ts](https://github.com/docmost/docmost/blob/0bd7ecb9b03a74e9a5e3f97b6457b82371c5ceb2/apps/server/src/core/attachment/attachment.controller.ts)
- [https://www.artresilia.com/docmost-v0-21-0-cve-2025-57231-unauthenticated-file-path-traversal/](https://www.artresilia.com/docmost-v0-21-0-cve-2025-57231-unauthenticated-file-path-traversal/)

## Related threats

- [Docmost ZIP bomb in page-import feature](https://junglewise.ai/threats/cve-2026-65827-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost privilege escalation in workspace invitation](https://junglewise.ai/threats/cve-2026-52853-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost access control bypass in transclusion API](https://junglewise.ai/threats/cve-2026-52850-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost authorization bypass in page export](https://junglewise.ai/threats/cve-2026-48073-docmost-is-open-source-collaborative-wiki-and-documentation)
- [Docmost path traversal in avatar and logo endpoint](https://junglewise.ai/threats/cve-2026-48072-docmost-is-open-source-collaborative-wiki-and-documentation)