PT-2026-3091 · Docmost · Docmost

Ramadhanamizudin · Publicado 2026-01-15 · Atualizado 2026-01-15 · CVE-2026-22249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docmost versions 0.21.0 through 0.23.999

Description Docmost, an open-source collaborative wiki and documentation software, has a flaw where improper filename validation in the Zip Import Feature (ZipSlip) allows for arbitrary file writing. This occurs in apps/server/src/integrations/import/utils/file.utils.ts due to the lack of filename validation.

Recommendations Update to version 0.24.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-22249

GHSA-54PM-HQXM-54WG

Produtos afetados

Docmost

Referências · 8

• 🔥 https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22249.json · Exploit
• https://github.com/docmost/docmost/commit/c3b350d943108552e20654580005cd6f6c78ab05 · Correção
• https://github.com/docmost/docmost/pull/1753 · Nota
• https://github.com/docmost/docmost/releases/tag/v0.24.0 · Nota
• https://osv.dev/vulnerability/CVE-2026-22249 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2011926068748566876 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22249 · Nota de Segurança