CVE-2026-24045

Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.

• CWE-79

• https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9Patch
• https://github.com/docmost/docmost/releases/tag/v0.25.0Product, Release Notes
• https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wqExploit, Third Party Advisory
• https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wqExploit, Third Party Advisory

Published

Feb 10, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24039Horilla is a free and open source Human Resource Management …4.3
• CVE-2026-2404CWE-116 Improper Encoding or Escaping of Output vulnerabilit…5.3
• CVE-2026-24040jsPDF is a library to generate PDFs in JavaScript. Prior to …4.8
• CVE-2026-24042Appsmith is a platform to build admin panels, internal tools…9.8
• CVE-2026-24043jsPDF is a library to generate PDFs in JavaScript. Prior to …5.4
• CVE-2026-24044Element Server Suite Community Edition (ESS Community) deplo…9.2
• CVE-2026-24046Backstage is an open framework for building developer portal…7.1
• CVE-2026-24047Backstage is an open framework for building developer portal…6.3
• CVE-2026-24048Backstage is an open framework for building developer portal…3.7
• CVE-2026-24049wheel is a command line tool for manipulating Python wheel f…5.5
• CVE-2026-2405CWE-400 Uncontrolled Resource Consumption vulnerability exis…6.5
• CVE-2026-24050Zulip is an open-source team collaboration tool. From 5.0 to…5.4