docmost records

9 published records for vendor docmost.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 44.4%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-22249No exploit	Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)docmost · docmost · CWE-22 Pre-auth Path traversal	Critical9.8	—	0.6%	Jan 15, 2026
25Monitor	CVE-2026-23630No exploit	Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid renderingdocmost · docmost · CWE-79 XSS	Medium6.3	—	0.3%	Jan 21, 2026
24Monitor	CVE-2025-55574No exploit	Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary codedocmost · docmost · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.3%	Aug 25, 2025
21Monitor	CVE-2026-34213Proof of concept	Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validationdocmost · docmost · CWE-639 Broken access control (IDOR)	Medium5.4	—	0.3%	Apr 14, 2026
21Monitor	CVE-2026-34212Proof of concept	Docmost page content has stored XSS via unsanitized attachment URLsdocmost · docmost · CWE-79 XSS	Medium5.4	—	0.2%	Apr 14, 2026
21Monitor	CVE-2026-24045No exploit	Docmost Affected by Stored XSS in Public Share Pagedocmost · docmost · CWE-79 RCE XSS	Medium5.4	—	0.2%	Feb 10, 2026
21Monitor	CVE-2026-40927No exploit	Docmost: XSS in Comments with JavaScript URIdocmost · docmost · CWE-79 XSS	Medium5.4	—	0.2%	Apr 21, 2026
18Monitor	CVE-2026-33193No exploit	Docmost vulnerable to stored XSS via MIME type spoofingdocmost · docmost · CWE-79 XSS	Medium4.6	—	0.2%	Apr 14, 2026
17Monitor	CVE-2026-33146Proof of concept	Docmost's Public Share Search Exposes Metadata of Restricted Childrendocmost · docmost · CWE-285 Pre-auth Broken access control (IDOR)	Medium4.3	—	0.3%	Apr 14, 2026

CVE-2026-22249
39Monitor
Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Path traversal
docmost · docmostJan 15, 2026
CVE-2026-23630
25Monitor
Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering
MediumCVSS 6.3No exploitEPSS 0%
- XSS
docmost · docmostJan 21, 2026
CVE-2025-55574
24Monitor
Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
docmost · docmostAug 25, 2025
CVE-2026-34213
21Monitor
Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation
MediumCVSS 5.4Proof of conceptEPSS 0%
- Broken access control (IDOR)
docmost · docmostApr 14, 2026
CVE-2026-34212
21Monitor
Docmost page content has stored XSS via unsanitized attachment URLs
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
docmost · docmostApr 14, 2026
CVE-2026-24045
21Monitor
Docmost Affected by Stored XSS in Public Share Page
MediumCVSS 5.4No exploitEPSS 0%
- RCE
- XSS
docmost · docmostFeb 10, 2026
CVE-2026-40927
21Monitor
Docmost: XSS in Comments with JavaScript URI
MediumCVSS 5.4No exploitEPSS 0%
- XSS
docmost · docmostApr 21, 2026
CVE-2026-33193
18Monitor
Docmost vulnerable to stored XSS via MIME type spoofing
MediumCVSS 4.6No exploitEPSS 0%
- XSS
docmost · docmostApr 14, 2026
CVE-2026-33146
17Monitor
Docmost's Public Share Search Exposes Metadata of Restricted Children
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
docmost · docmostApr 14, 2026