Skip to content
Heist/ feed
Back to feed
Medium

Docmost: Public image fileName path traversal leads to unauthorized local file read

Type: advisorySources: OSV

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-48072
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 20:30 UTC · Revision 1

Source evidence

Docmost: Public image fileName path traversal leads to unauthorized local file read

core-osv · Original source

Published 24 Sept 2026, 18:30 UTC

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.

osv:CVE-2026-48072
Complete source record
{
  "id": "e2dce7f132b89697121d261594da2cb06f15a6b6a7b6fea8d0b44a2a9c583be2",
  "url": "https://osv.dev/vulnerability/CVE-2026-48072",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Docmost: Public image fileName path traversal leads to unauthorized local file read",
    "summary": "Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1.",
    "evidence": "osv:CVE-2026-48072",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-48072",
      "aliases": [
        "CVE-2026-48072",
        "GHSA-9f58-29hm-mgp2"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/docmost/docmost",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "980521f95792ddd382ebbc275467a8319a351bae"
                },
                {
                  "fixed": "a573acedd0317f3472cb0f8b95f6aa15315312e5"
                },
                {
                  "fixed": "ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "0.80.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "a573acedd0317f3472cb0f8b95f6aa15315312e5"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "980521f95792ddd382ebbc275467a8319a351bae"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v0.80.1"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.70.2",
            "v0.70.1",
            "v0.71.1",
            "v0.71.0",
            "v0.70.3",
            "v0.70.0",
            "v0.25.3",
            "v0.25.2",
            "v0.25.1",
            "v0.25.0",
            "v0.25.0-beta.1",
            "v0.24.1",
            "v0.24.0",
            "v0.23.2",
            "v0.23.1",
            "v0.23.0",
            "v0.22.2",
            "v0.22.1",
            "v0.22.0",
            "v0.21.0",
            "v0.20.4",
            "v0.20.3",
            "v0.20.2",
            "v0.20.1",
            "v0.20.0",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.0",
            "v0.8.4",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.0",
            "v0.6.2",
            "v0.6.1",
            "v0.6.0",
            "v0.5.0",
            "v0.4.1",
            "v0.4.0",
            "v0.3.1",
            "v0.3.0",
            "v0.2.10",
            "v0.2.9",
            "v0.2.8",
            "v0.2.7",
            "v0.2.5",
            "v0.2.4",
            "0.2.3",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48072.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.729822129Z",
      "provider": "osv",
      "references": [
        "https://github.com/docmost/docmost/releases/tag/v0.80.1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48072.json",
        "https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-48072",
        "https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5",
        "https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48072.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-48072",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520319,
  "published_at": "2026-09-24T18:30:57.781+00:00"
}