CVE-2026-24045

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
docmost	docmost	>= 0.20.0, < 0.25.0

References

https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9Patch
https://github.com/docmost/docmost/releases/tag/v0.25.0Product, Release Notes
https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wqExploit, Third Party Advisory
https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wqExploit, Third Party Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-240467.1Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable CVE-2026-240476.3Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the b CVE-2026-240483.7Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setu CVE-2026-240495.5wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack funct CVE-2026-24056.5CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of se CVE-2026-240505.4Zulip is an open-source team collaboration tool. From 5.0 to before 11.5, some administrative actions on the user profile were susceptible t CVE-2026-240517.0OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacki CVE-2026-240527.4Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain ver CVE-2026-240536.5Claude Code is an agentic coding tool. Prior to version 2.0.74, due to a Bash command validation flaw in parsing ZSH clobber syntax, it was CVE-2026-2405410.0Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like cont CVE-2026-240555.3Langfuse is an open source large language model engineering platform. In versions 3.146.0 and below, the /api/public/slack/install endpoint CVE-2026-240566.5pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a `file:` (directory) or `git:` dependency, it follows symlinks and