CVE-2026-48070

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.

• CWE-22

• https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5
• https://github.com/docmost/docmost/releases/tag/v0.80.1
• https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48065pam_usb provides hardware authentication for Linux using ord…6.7
• CVE-2026-48066pam_usb provides hardware authentication for Linux using ord…5.7
• CVE-2026-48067Filament is a collection of full-stack components for accele…6.5
• CVE-2026-48068@grpc/grps-js implements the core functionality of gRPC pure…7.5
• CVE-2026-48069@grpc/grps-js implements the core functionality of gRPC pure…7.5
• CVE-2026-4807The Appointment Booking Calendar plugin for WordPress is vul…6.5
• CVE-2026-48071OpenReception's appointment booking software provides an end…5.8
• CVE-2026-48072Docmost is open-source collaborative wiki and documentation …5.3
• CVE-2026-48073Docmost is open-source collaborative wiki and documentation …4.3
• CVE-2026-48074OpenReception's appointment booking software provides an end…2.7
• CVE-2026-48075OpenReception's appointment booking software provides an end…6.5
• CVE-2026-48076OpenReception's appointment booking software provides an end…6.5