Excessive Resource Consumption in Docmost Open-Source Documentation Software

CVE-2026-65827

What is CVE-2026-65827?

Docmost, an open-source collaborative wiki and documentation software, is susceptible to a resource exhaustion vulnerability. Any authenticated member with edit permissions can exploit the page-import feature by uploading crafted ZIP archives. The ZIP extractor processes these entries without restrictions on total uncompressed size, per-entry size, or entry count. This can result in substantial increases in disk usage, as the default extraction limit allows a single nested ZIP to expand to several gigabytes. If managed improperly, this excessive disk consumption can crash the import worker, compromising the operational integrity of the application for all users. The issue has been addressed in version 0.95.0.

References