CVE-2025-57231

HighCVSS 7.5/10Last modified Sep 22, 2026

Description

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-57244.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been classified as problematic. Affected is an unkn CVE-2025-572406.1Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the CVE-2025-572445.4OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field ac CVE-2025-572479.1The BATBToken smart contract (address 0xfbf1388408670c02f0dbbb74251d8ded1d63b7a2, Compiler Version v0.8.26+commit.8a97fa7a) contains incorre CVE-2025-572487.3A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is CVE-2025-57254.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vuln CVE-2025-572546.5An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers CVE-2025-57265.4A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been rated as problematic. Affected by this issue i CVE-2025-572637.2An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via th CVE-2025-572669.8An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers t CVE-2025-57275.4A vulnerability classified as problematic has been found in SourceCodester Student Result Management System 1.0. This affects an unknown par CVE-2025-572755.5Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.