CVE-2026-22249: falha de alta gravidade em docmost
Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.6%
probabilidade de exploração
0.6%top 55% das CVEs
exploração observada
nãonenhuma fonte reporta
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
docmost · docmostCVEs relacionadas — docmost
No mesmo produto, das mais perigosas para as menos.
CVE-2026-48070HIGHDocmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletionEPSS 0.4%CVE-2026-48072MEDIUMDocmost: Public image fileName path traversal leads to unauthorized local file readEPSS 0.3%CVE-2026-33146MEDIUMDocmost's Public Share Search Exposes Metadata of Restricted ChildrenEPSS 0.3%CVE-2026-65827MEDIUMDocmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of serviceEPSS 0.3%CVE-2026-23630MEDIUMDocmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid renderingEPSS 0.3%CVE-2026-34213MEDIUMDocmost has cross-page attachment overwrite via flawed attachmentId overwrite validationEPSS 0.3%