CVE-2026-65827
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-65827
EUVD
EUVD-2026-86386

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Docmost is open-source wiki software. From versions 0.21.0 to 0.95.0, authenticated users with edit rights could upload ZIP archives via the page-import feature. The ZIP extraction did not enforce limits on total uncompressed size, individual file size, or file count. This allowed deeply nested ZIP files to expand significantly beyond the 200 MB upload limit, causing disk exhaustion that could crash the server or take down the entire instance for all users.

Detection Guidance

Monitor disk usage in the server's temp directory during page imports. Check for unusually large files or excessive extraction activity. Review logs for failed import attempts or crashes in the Docmost application.

Impact Analysis

If you use Docmost versions between 0.21.0 and 0.95.0, an attacker with edit access could upload a malicious ZIP file to exhaust server disk space. This may cause the application to crash, degrade performance for all users, or make the system unavailable until disk space is freed or the instance is restarted.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing system unavailability or degradation due to disk exhaustion. GDPR requires data integrity and availability, while HIPAA mandates access to protected health information. A denial-of-service condition may violate these requirements by disrupting access to critical data.

Mitigation Strategies

Upgrade Docmost to version 0.95.0 or later. Restrict workspace member edit rights to trusted users. Implement disk usage monitoring and set quotas for the temp directory. Disable the page-import feature if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart