CVE-2026-48072: Docmost: Public image fileName path traversal leads to unauthorized local file read
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docmostto a version that resolves this vulnerability.Fixed in 0.80.1
Event History
Frequently Asked Questions
Which Docmost versions need to be remediated?
Docmost versions prior to 0.80.1 are affected. Upgrade to version 0.80.1 to obtain the fix.
Does exploitation require authentication or user interaction?
No. The affected avatar and logo image endpoints can be exploited by an unauthenticated attacker, with no user interaction required.
What information could an attacker access?
An attacker can read local storage objects outside the intended avatar or logo image directory, but only where the target object's final basename satisfies the endpoint's UUID validation.