CVE-2026-33193: Docmost Stored XSS Vulnerability

CVE-2026-33193 Overview

Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.

Critical Impact

Stored XSS vulnerability allows attackers to inject persistent malicious scripts that execute in the context of other users' sessions, potentially leading to session hijacking, credential theft, and unauthorized actions within the Docmost collaborative platform.

Affected Products

• Docmost versions prior to 0.70.0
• Docmost collaborative wiki and documentation software (all vulnerable versions)

Discovery Timeline

• 2026-04-14 - CVE CVE-2026-33193 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-33193

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The stored XSS variant present in Docmost is particularly dangerous because malicious payloads persist in the application database and execute whenever other users access the affected content.

The vulnerability stems from improper handling of MIME type spoofing, which allows an attacker to bypass content validation mechanisms. When uploading or submitting content to the Docmost platform, the application fails to properly validate the actual content type against the declared MIME type, enabling attackers to inject script content disguised as benign file types.

In a collaborative wiki environment like Docmost, this vulnerability is especially concerning as multiple users routinely access shared documentation, maximizing the potential blast radius of a successful attack.

Root Cause

The root cause of this vulnerability lies in the application's reliance on client-supplied MIME type headers without performing adequate server-side content inspection. When processing uploaded content or user-submitted data, Docmost trusts the MIME type declaration provided by the client rather than inspecting the actual content to determine its true nature.

This trust relationship allows attackers to craft malicious payloads with spoofed MIME types that bypass security filters designed to block executable script content. The injected scripts are then stored in the application's data store and served to other users without proper sanitization or encoding.

Attack Vector

The attack is network-based and requires low privileges with user interaction. An authenticated attacker can exploit this vulnerability by uploading or submitting content with a spoofed MIME type that contains embedded JavaScript or other executable scripts. The malicious content is stored by the application and subsequently rendered in the browsers of other users who view the affected wiki pages or documentation.

When a victim user accesses the compromised content, the malicious script executes within their browser session with full access to their session cookies, local storage, and the DOM. This enables various attack scenarios including session token theft, keylogging, phishing overlay injection, and performing actions on behalf of the victim user.

For detailed technical information about the vulnerability mechanism, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33193

Indicators of Compromise

• Unusual script tags or JavaScript code embedded in wiki page content or documentation entries
• User reports of unexpected browser behavior, pop-ups, or redirects when viewing Docmost pages
• Suspicious file uploads with mismatched extensions and content types
• Authentication tokens or session data being transmitted to external domains
• Unexpected modifications to user account settings or wiki content

Detection Strategies

• Implement Content Security Policy (CSP) headers with reporting enabled to detect inline script execution attempts
• Monitor web server logs for requests containing encoded script patterns or suspicious payloads
• Deploy web application firewall (WAF) rules to detect XSS attack patterns in uploaded content
• Review stored content in the Docmost database for script injection patterns
• Analyze network traffic for data exfiltration attempts to unknown external domains

Monitoring Recommendations

• Enable verbose logging for all content upload and modification operations in Docmost
• Configure alerts for CSP violation reports indicating attempted script injection
• Monitor user session patterns for anomalies that may indicate session hijacking
• Implement file integrity monitoring on Docmost's storage directories
• Track and alert on unusual patterns of wiki page access or rapid content modifications

How to Mitigate CVE-2026-33193

Immediate Actions Required

• Upgrade Docmost to version 0.70.0 or later immediately
• Audit existing wiki content and documentation for embedded malicious scripts
• Invalidate all active user sessions to prevent exploitation of potentially compromised tokens
• Review recent content changes and uploads for suspicious activity
• Implement Content Security Policy headers as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in Docmost version 0.70.0. Organizations running affected versions should upgrade to this version or later to remediate the vulnerability. The patch implements proper MIME type validation and content inspection to prevent MIME type spoofing attacks.

For complete patch details and upgrade instructions, refer to the GitHub Security Advisory.

Workarounds

• Restrict file upload capabilities to trusted users only until the patch can be applied
• Implement strict Content Security Policy headers to mitigate script execution (script-src 'self')
• Deploy a web application firewall with XSS protection rules in front of Docmost
• Limit user registration and enforce multi-factor authentication to reduce attacker access
• Consider temporarily disabling file upload functionality if not critical to operations

# Content Security Policy header configuration example for nginx
# Add to your Docmost nginx configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; frame-ancestors 'self';" always;

# Enable X-Content-Type-Options to prevent MIME type sniffing
add_header X-Content-Type-Options "nosniff" always;

# Enable XSS protection header
add_header X-XSS-Protection "1; mode=block" always;