CVE-2026-65827: Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Docmostto a version that resolves this vulnerability.Fixed in 0.95.0
Event History
Frequently Asked Questions
Who can trigger the issue?
Any authenticated workspace member who has edit rights to a space can exploit it. No administrative privileges or user interaction are required.
Are deployments using the default upload limit still exposed?
Yes. An archive within the default 200 MB upload limit can expand to multiple GB during extraction, including through one automatically extracted nested ZIP.
What systems are affected?
Docmost versions from 0.21.0 until 0.95.0 are affected. Version 0.95.0 fixes the issue.
What is the operational impact of exploitation?
Extracted archive contents are written to the server temporary directory without limits on total uncompressed size, per-entry size, or entry count. Disk exhaustion can crash the import worker and degrade or take down the instance for all tenants.