CVE-2026-48073

Deferred Deferred - Pending Action

Authenticated Export Path Traversal in Docmost

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-48073

EUVD

EUVD-2026-86392

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Docmost, an open-source wiki and documentation tool. A low-privileged authenticated user can manipulate an export request to include restricted files in a ZIP archive, even though direct access to those files is blocked. The issue occurs when exporting a page with attachments using a forged attachment ID from a restricted page.

Detection Guidance

To detect CVE-2026-48073, check if your Docmost instance is running a vulnerable version (0.70.0 to 0.80.1). Verify if restricted attachments can be accessed through page exports by testing export functionality with includeAttachments=true. Review exported ZIP archives for unauthorized files.

Impact Analysis

An attacker could gain access to sensitive information stored in restricted pages by exporting a page they control. This could lead to unauthorized data exposure, confidentiality breaches, or compliance violations depending on the content of the restricted pages.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using Docmost may face compliance risks if restricted data is exposed through this exploit.

Mitigation Strategies

Upgrade Docmost to version 0.80.1 or later to fix the vulnerability. Review exported ZIP archives for unauthorized attachments and restrict page editing permissions for low-privileged users.

Hi! I’m here to help you understand CVE-2026-48073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70