CVE-2026-22249
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| docmost | docmost | to 0.24.0 (exc) |
| docmost | docmost | 0.24.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22249 is a vulnerability in the Docmost open-source wiki software where the ZIP import feature does not properly validate filenames inside ZIP archives. This allows an attacker to craft a malicious ZIP file with path traversal sequences (like ../../) that cause files to be written outside the intended extraction directory, potentially overwriting critical files. This is known as a ZipSlip vulnerability and can lead to arbitrary file write on the server. [4]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to overwrite important files in the Docmost application directory by uploading a specially crafted ZIP file. This can lead to remote code execution if the attacker deploys a web shell, or cause denial of service by crashing the application. The impact includes integrity loss (file modification) and high availability impact (application disruption). [4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious ZIP file uploads or imports that contain path traversal sequences such as '../' in filenames. You can inspect ZIP files before import to check for unsafe entries. For example, you can use the 'zipinfo' or 'unzip -l' command to list the contents of a ZIP file and look for filenames with directory traversal patterns. Example command: 'unzip -l suspicious.zip | grep "\.\./"' to detect entries attempting path traversal. Additionally, monitoring application logs for warnings about invalid or skipped ZIP entries (as per the patched code) can help detect exploitation attempts. [4]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Docmost to version 0.24.0 or later, where the vulnerability is fixed by implementing strict validation and normalization of ZIP entry names, path traversal protection, and exclusion of unsafe entries during ZIP extraction. If upgrading immediately is not possible, avoid importing ZIP files from untrusted sources and monitor for suspicious ZIP import activity. Applying the patch described in Resources 1 and 2, which includes filename validation using 'yauzl.validateFileName', path resolution checks, and skipping unsafe entries, will mitigate the risk. [1, 2, 3]