CVE-2026-34212: Docmost page content has stored XSS via unsanitized attachment URLs
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious javascript: URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docmostto a version that resolves this vulnerability.Fixed in 0.71.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34212?
CVE-2026-34212 is a high-severity vulnerability that allows stored cross-site scripting (XSS) due to unsanitized attachment URLs.
How do I fix CVE-2026-34212?
To fix CVE-2026-34212, upgrade to Docmost version 0.71.0 or later, which addresses the unsanitized attachment URL vulnerability.
Who is affected by CVE-2026-34212?
CVE-2026-34212 affects all users of Docmost versions prior to 0.71.0.
What type of vulnerability is CVE-2026-34212?
CVE-2026-34212 is categorized as a stored cross-site scripting (XSS) vulnerability.
How can an attacker exploit CVE-2026-34212?
An attacker can exploit CVE-2026-34212 by storing a malicious JavaScript payload in an attachment URL, which is then executed in the browser of anyone accessing the content.