CVE-2026-22249

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
docmost	docmost	< 0.24.0

References

https://github.com/docmost/docmost/commit/c3b350d943108552e20654580005cd6f6c78ab05Patch
https://github.com/docmost/docmost/pull/1753Issue Tracking
https://github.com/docmost/docmost/releases/tag/v0.24.0Release Notes
https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wgExploit, Vendor Advisory
https://github.com/docmost/docmost/security/advisories/GHSA-54pm-hqxm-54wgExploit, Vendor Advisory

Timeline

Published: Jan 15, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-22259.8A flaw has been found in itsourcecode News Portal Project 1.0. This vulnerability affects unknown code of the file /admin/index.php of the c CVE-2026-222505.5wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs.CVE-2026-222515.5wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. Th CVE-2026-222529.9LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands witho CVE-2026-222535.4Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the LFS lock deletion end CVE-2026-222543.5Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow CVE-2026-222558.8iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium CVE-2026-222568.8Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generate an file view of a folder which include a ren CVE-2026-222578.8Salvo is a Rust web backend framework. Prior to version 0.88.1, the function list_html generates a file view of a folder without sanitizing CVE-2026-222587.5Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buf CVE-2026-222597.5Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume l CVE-2026-22267.2A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.php of the component