Executive Summary

CVE-2026-22249 is a vulnerability in the Docmost open-source wiki software where the ZIP import feature does not properly validate filenames inside ZIP archives. This allows an attacker to craft a malicious ZIP file with path traversal sequences (like ../../) that cause files to be written outside the intended extraction directory, potentially overwriting critical files. This is known as a ZipSlip vulnerability and can lead to arbitrary file write on the server. [4]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to overwrite important files in the Docmost application directory by uploading a specially crafted ZIP file. This can lead to remote code execution if the attacker deploys a web shell, or cause denial of service by crashing the application. The impact includes integrity loss (file modification) and high availability impact (application disruption). [4]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious ZIP file uploads or imports that contain path traversal sequences such as '../' in filenames. You can inspect ZIP files before import to check for unsafe entries. For example, you can use the 'zipinfo' or 'unzip -l' command to list the contents of a ZIP file and look for filenames with directory traversal patterns. Example command: 'unzip -l suspicious.zip | grep "\.\./"' to detect entries attempting path traversal. Additionally, monitoring application logs for warnings about invalid or skipped ZIP entries (as per the patched code) can help detect exploitation attempts. [4]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Docmost to version 0.24.0 or later, where the vulnerability is fixed by implementing strict validation and normalization of ZIP entry names, path traversal protection, and exclusion of unsafe entries during ZIP extraction. If upgrading immediately is not possible, avoid importing ZIP files from untrusted sources and monitor for suspicious ZIP import activity. Applying the patch described in Resources 1 and 2, which includes filename validation using 'yauzl.validateFileName', path resolution checks, and skipping unsafe entries, will mitigate the risk. [1, 2, 3]

Useful 0 Not Useful 0