CVE-2026-61645: Docat has Arbitrary File Upload exists in Upload API
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docatto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
What does version 1.6.0 address, and what risk may remain after upgrading?
Version 1.6.0 mitigates filename-based path traversal in the Upload API. The verified patch does not establish remediation for unrestricted file types or for malicious uploaded-content effects that depend on the deployment environment.
What could successful exploitation allow in different deployments?
An attacker may overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, this may enable remote code execution or cross-site scripting that steals cookies or redirects users.