PT-2026-32929 · Docmost · Docmost

B4Sh2 + 1 · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-33193

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.70.0

Description Docmost is open-source collaborative wiki and documentation software. The software is subject to a stored cross-site scripting (XSS) attack, which occurs when an application includes untrusted data in a web page without proper validation, allowing a malicious script to be permanently stored on the server. This issue is caused by improper handling of MIME type spoofing, where an attacker can misrepresent the file type of an uploaded file to trick the browser into executing it as a script.

Recommendations Update to version 0.70.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33193

Affected Products

Docmost

References · 4

• https://github.com/docmost/docmost/security/advisories/GHSA-7cq4-577p-wp6p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33193 · Security Note
• https://twitter.com/CVEnew/status/2044338915222679829 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044313219393597817 · Twitter Post