Arbitrary File Deletion in Docmost Open-Source Collaborative Software
CVE-2026-48070

7.1HIGH

Key Information:

Vendor

Docmost

Status
Docmost
Vendor
CVE Published:
24 September 2026

What is CVE-2026-48070?

The Docmost application, an open-source collaborative wiki and documentation platform, contains a vulnerability that allows authenticated users to store malicious avatar URLs. When these URLs are reused during avatar cleanup, it leads to the unintended deletion of arbitrary local files and directories accessible by the service account. This flaw can be exploited by low-privileged users, posing a significant risk to the integrity of the local storage. The issue has been resolved in version 0.80.1.

Affected Version(s)

docmost < 0.80.1

References

https://github.com/docmost/docmost/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/docmost/docmost/commit/a573acedd0317f3...
x_refsource_MISC
https://github.com/docmost/docmost/releases/tag/v0.80.1
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.