CVE-2026-40927: Docmost XSS Vulnerability

CVE-2026-40927 Overview

CVE-2026-40927 is a stored Cross-Site Scripting (XSS) vulnerability discovered in Docmost, an open-source collaborative wiki and documentation software. Prior to version 0.80.0, the application fails to properly sanitize JavaScript URI schemes when users include links in page comments. When another user clicks on a malicious link containing a JavaScript URI, the embedded script executes in the context of their browser session, potentially leading to session hijacking, data theft, or other malicious actions.

Critical Impact

Authenticated attackers can inject persistent JavaScript payloads through page comments, compromising other users who interact with the malicious links within the collaborative documentation platform.

Affected Products

• Docmost versions prior to 0.80.0
• All installations using the comment functionality on wiki pages

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40927 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40927

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in how Docmost processes links embedded within page comments. The application does not adequately validate or sanitize the URI scheme of user-supplied links, allowing attackers to inject JavaScript URIs (e.g., javascript:alert('XSS')) that execute when clicked by other users.

The attack requires low privileges (any authenticated user who can leave comments) and user interaction (victim must click the malicious link). However, because the payload is stored in the comment and persists on the page, all users viewing that comment become potential victims. This makes it a stored XSS vulnerability, which is generally more dangerous than reflected XSS since it does not require the attacker to trick each victim individually.

Root Cause

The root cause is insufficient input validation on URL schemes within the comment link functionality. The application accepts and renders links without checking whether the URI scheme is safe (such as http, https, or mailto). By allowing arbitrary URI schemes, including the javascript: protocol, the application enables script injection through seemingly legitimate link syntax.

Attack Vector

The attack is network-based and targets authenticated users of the Docmost platform. An attacker with comment privileges creates a comment containing a link with a JavaScript URI payload. When other users view the page and click the link, the JavaScript executes in their browser context with access to their session cookies, local storage, and DOM. This can be leveraged to steal session tokens, perform actions on behalf of the victim, or redirect them to malicious sites.

The vulnerability is exploited by inserting a JavaScript URI as a link within a comment. When rendered, the link appears legitimate but executes arbitrary JavaScript when clicked. The payload could perform actions such as sending the user's session cookie to an attacker-controlled server or modifying page content. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-40927

Indicators of Compromise

• Presence of javascript: URI schemes in comment content stored in the database
• Unusual outbound requests originating from user browsers after viewing comment pages
• User reports of unexpected behavior or redirects when clicking links in comments

Detection Strategies

• Implement content scanning rules to detect javascript:, data:, and vbscript: URI schemes in comment data
• Deploy Web Application Firewall (WAF) rules to flag or block requests containing JavaScript URI patterns in comment submissions
• Review application logs for comment creation events containing suspicious URI patterns

Monitoring Recommendations

• Monitor for anomalous JavaScript execution patterns on documentation pages
• Set up alerting for bulk comment modifications that may indicate payload injection
• Establish baseline metrics for comment link click-through rates to detect unusual activity

How to Mitigate CVE-2026-40927

Immediate Actions Required

• Upgrade Docmost to version 0.80.0 or later immediately
• Audit existing comments in the database for malicious JavaScript URIs and remove any suspicious content
• Consider temporarily disabling the comment feature if immediate patching is not possible

Patch Information

The vulnerability is fixed in Docmost version 0.80.0. Users should upgrade to this version or later to remediate the issue. The fix implements proper URI scheme validation to prevent JavaScript and other dangerous protocols from being included in comment links. For more details, refer to the GitHub Security Advisory.

Workarounds

• Implement a Content Security Policy (CSP) header to restrict inline script execution, which can mitigate the impact of XSS attacks
• Use input sanitization at the application or reverse proxy level to strip or encode JavaScript URIs before storage
• Restrict comment functionality to trusted users only until the patch can be applied

# Example CSP header configuration for nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;