CVE-2026-48070
Deferred Deferred - Pending Action

Authenticated Path Traversal in Docmost Wiki Software

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-48070
EUVD
EUVD-2026-86345

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48070 is a path traversal vulnerability in Docmost, an open-source wiki software. Authenticated users can manipulate the avatarUrl parameter in their profile to include malicious path sequences. When the system cleans up avatars during user updates or deletions, it uses this stored URL to delete arbitrary local files or directories accessible by the Docmost service account. This affects version 0.80.0 and was patched in 0.80.1.

Detection Guidance

Check Docmost version with: curl -s https://your-docmost-instance.com/api/version | grep version. If version is below 0.80.1, the system is vulnerable. Inspect server logs for unusual file deletion events or path traversal patterns in avatar cleanup operations.

Impact Analysis

A low-privileged attacker could delete critical files or directories on the server running Docmost. This could disrupt service availability, corrupt data, or lead to further system compromise if sensitive files are removed. The impact is limited to local storage deployments.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file deletion on the server. For GDPR, unauthorized file access or deletion may violate data integrity and security principles. For HIPAA, if the affected system processes protected health information stored in local files, this vulnerability could lead to unauthorized data loss or corruption.

Mitigation Strategies

Upgrade Docmost to version 0.80.1 or later immediately. Review and restrict file system permissions for the Docmost service account to limit access to critical directories. Monitor for unauthorized file deletions or system changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart