Approved changes feed: RSS · Atom
cpe:2.3:a:docmost:docmost:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Docmost (0e883cd1-d661-5640-b329-3a365fa366e2) |
|---|---|
| Product | Docmost (c23dac35-b3c0-5f21-a4c7-e31a50c2edd8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/docmost/docmost |
purl2cpe | 2026-07-28 16:40:58.237142 |
pkg:sourceforge/docmost.mirror |
purl2cpe | 2026-06-01 10:13:14.935237 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-40927 |
vulnerable | 2026-06-08 08:01:21.142654 |
Docmost: XSS in Comments with JavaScript URI
MEDIUM (5.4)
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.
Published: 2026-04-21T20:52:29.313Z
Updated: 2026-04-22T17:42:15.540Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34213 |
vulnerable | 2026-06-08 07:59:11.894146 |
Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation
MEDIUM (5.4)
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
Published: 2026-04-14T21:49:55.380Z
Updated: 2026-04-15T13:31:17.467Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34212 |
vulnerable | 2026-06-08 07:59:11.893841 |
Docmost page content has stored XSS via unsanitized attachment URLs
MEDIUM (5.4)
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
Published: 2026-04-14T21:42:44.202Z
Updated: 2026-04-15T20:02:55.239Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33193 |
vulnerable | 2026-06-08 07:59:09.326034 |
Docmost vulnerable to stored XSS via MIME type spoofing
MEDIUM (4.6)
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.
Published: 2026-04-14T21:39:45.500Z
Updated: 2026-04-16T13:51:42.724Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33146 |
vulnerable | 2026-06-08 07:59:09.156530 |
Docmost's Public Share Search Exposes Metadata of Restricted Children
MEDIUM (4.3)
Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets through the public search endpoint (`POST /api/search/share-search`) for publicly shared content. This flaw allows unauthenticated users to enumerate and retrieve content that should remain hidden from public share viewers, leading to a confidentiality breach. Version 0.70.3 contains a patch.
Published: 2026-04-14T21:36:53.562Z
Updated: 2026-04-15T14:28:08.044Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24045 |
vulnerable | 2026-06-08 07:51:16.608754 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23630 |
vulnerable | 2026-06-08 07:51:15.691348 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22249 |
vulnerable | 2026-06-08 07:49:17.776917 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-55574 |
vulnerable | 2026-06-08 07:33:15.036114 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.