PT-2026-3091 · Docmost · Docmost

Ramadhanamizudin · Published 2026-01-15 · Updated 2026-01-15 · CVE-2026-22249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Docmost versions 0.21.0 through 0.23.999

Description Docmost, an open-source collaborative wiki and documentation software, has a flaw where improper filename validation in the Zip Import Feature (ZipSlip) allows for arbitrary file writing. This occurs in apps/server/src/integrations/import/utils/file.utils.ts due to the lack of filename validation.

Recommendations Update to version 0.24.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-22249

GHSA-54PM-HQXM-54WG

Affected Products

Docmost

References · 8

• 🔥 https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22249.json · Exploit
• https://github.com/docmost/docmost/commit/c3b350d943108552e20654580005cd6f6c78ab05 · Patch
• https://osv.dev/vulnerability/CVE-2026-22249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22249 · Security Note
• https://github.com/docmost/docmost/pull/1753 · Note
• https://github.com/docmost/docmost/releases/tag/v0.24.0 · Note
• https://twitter.com/CVEnew/status/2011926068748566876 · Twitter Post