Executive brief
Docmost is an open-source platform used for collaborative documentation and wikis. A security flaw allows users with low-level access to upload files that trick the system into executing malicious scripts in the browsers of other users. This could lead to unauthorized access to user accounts, theft of sensitive session data, or the defacement of documentation pages.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Docmost versions prior to 0.70.0. The root cause is improper validation and handling of MIME types during file uploads, allowing for MIME type spoofing. An authenticated attacker with low privileges can upload a malicious file that, when viewed by another user (such as an administrator), executes arbitrary JavaScript in their browser. This occurs because the application fails to properly neutralize input during web page generation (CWE-79). The vulnerability is fixed in version 0.70.0.
Affected products
- Docmost Docmost < 0.70.0
Timeline
- 2026-04-14: advisory: GitHub Security Advisory published
- 2026-04-14: disclosed
- 2026-04-14: patched: Version 0.70.0 released with a fix