Executive brief
Docs is an open-source web-based text editor used for collaborative document creation and management. A vulnerability in its cors-proxy endpoint allows unauthenticated attackers to make outbound HTTP requests to arbitrary internal network addresses by providing a document UUID, potentially exposing internal services and exfiltrating image content from protected networks.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the cors-proxy endpoint of Docs versions through 5.6.1. The vulnerable component fails to properly validate or restrict outbound requests initiated via a public document UUID parameter. Attackers can exploit DNS time-of-check-time-of-use (TOCTOU) race conditions and shared address space bypasses (e.g., 169.254.x.x) to access internal network resources. No authentication is required; the vulnerability is exploitable remotely over the network. An attacker can make the application fetch arbitrary URLs and exfiltrate image content from internal systems. Patches are available in newer versions beyond 5.6.1.
Affected products
- Suitenumerique Docs through 5.6.1
Timeline
- 2026-09-14: disclosed