CVE Intelligence
Analysis AI-assisted

CVE-2026-22249: Docmost Arbitrary File Write via Zip Import (ZipSlip)

Docmost versions from 0.21.0 up to before 0.24.0 do not validate filenames in the zip import feature, which can allow arbitrary file writes (ZipSlip, CWE-22). The issue is fixed in 0.24.0. NVD scores it 9.8 (critical) under CVSS 3.1, while GitHub scores it 7.1.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Docmost is an open-source collaborative wiki and documentation platform. The record describes a ZipSlip-style issue in its zip import feature: filenames inside imported archives are not validated, so entries may be written to locations outside the intended directory. The weakness is classified as CWE-22 (Path Traversal). The fix is available in 0.24.0.

Impact

  • An attacker who can supply a crafted zip archive through the import feature may be able to write files to arbitrary locations on the server, as allowed by the server process permissions.
  • NVD rates the issue critical (9.8, CVSS 3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). GitHub rates it 7.1 under the same CVSS version.
  • The actual consequences in a given deployment depend on the server configuration, the process privileges and what files are writable.

Affected products and versions

  • Docmost (product listed as Docmost Docmost) from 0.21.0 up to before 0.24.0.
  • Installations on 0.24.0 or later are listed as fixed in the sources consulted.

Exploitation status

  • The record shows the vulnerability is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC data in the record marks exploitation as proof of concept and automatable as no. This describes the available exploitation maturity, not confirmed attacks.
  • The EPSS probability in the record is 0.00557 (percentile 0.45705).

Remediation and mitigation

  • Upgrade Docmost to 0.24.0 or later, as recommended by the fix referenced in the vendor advisory and release notes.
  • Until the upgrade is applied, restrict who can use the zip import feature and review imports from untrusted sources.
  • Run the application with the least privileges needed, so that file writes are confined as far as possible.
  • The record does not describe a specific workaround; any interim measure should be confirmed with the vendor.

Detection guidance

  • Review server logs for import operations and for unexpected files created outside the expected import or storage directories.
  • Monitor for newly created or modified files in application directories that are not normally written by the wiki.
  • Audit accounts with access to the import function, since the record indicates no user interaction is required.

Limitations of the available information

  • The record does not include a detailed technical description of the exploitation path, and this analysis does not add any.
  • The CVSS scores differ between NVD (9.8) and GitHub (7.1); both are reported as given.
  • The EPSS date in the record (2026-10-23) is later than the publication date and should be verified against the source before relying on it.
  • Whether any workaround exists beyond upgrading is unknown from the record.

Frequently asked questions

Which Docmost versions are affected?

The record lists Docmost from 0.21.0 up to before 0.24.0 as affected.

Is there a fix?

Yes. The record states the vulnerability is fixed in 0.24.0, and a patch commit and release notes are referenced.

Is this vulnerability known to be exploited in the wild?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.