Arbitrary File Upload Vulnerability in Docat by Docat Org
CVE-2026-61645

9.1CRITICAL

Key Information:

Vendor

Docat-org

Status
Docat
Vendor
CVE Published:
29 October 2026

What is CVE-2026-61645?

The Docat product is susceptible to an arbitrary file upload vulnerability due to inadequate validation in the Upload API. This flaw allows attackers to upload files without sufficient checks, potentially enabling them to overwrite crucial configuration files or introduce malicious content to the server. Such actions could result in severe consequences such as remote code execution or cross-site scripting attacks. Users are strongly advised to upgrade to version 1.6.0, which mitigates filename-based path traversal issues. However, the patch does not fully address the unrestricted file types that could lead to deployment-dependent vulnerabilities.

Affected Version(s)

docat < 1.6.0

References

https://github.com/docat-org/docat/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/docat-org/docat/commit/85fc40e8348c632...
x_refsource_MISC
https://github.com/docat-org/docat/releases/tag/1.6.0
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.