CVE-2026-48070: Docmost Path Traversal Vulnerability

CVE-2026-48070 Overview

Docmost is an open-source collaborative wiki and documentation platform. Versions prior to 0.80.1 contain a path traversal vulnerability [CWE-22] in the avatar cleanup logic for local-storage deployments. Authenticated users can submit attacker-controlled avatarUrl values that are later processed by the avatar cleanup routine without confinement to the intended directory. A low-privileged authenticated user can trigger deletion of arbitrary local files or directories accessible to the Docmost service account. The issue is fixed in version 0.80.1.

Critical Impact
Authenticated low-privileged users can delete arbitrary files or directories reachable by the Docmost service account, enabling data loss, service disruption, and potential system compromise on local-storage deployments.

Affected Products

Docmost versions prior to 0.80.1
Local-storage deployments of Docmost
Self-hosted Docmost instances using filesystem backends

Discovery Timeline

2026-09-24 - CVE-2026-48070 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-48070

Vulnerability Analysis

The vulnerability resides in Docmost's attachment and user update logic. The UpdateUserDto object exposes an avatarUrl field accepted directly from authenticated clients. The server later uses this value during avatar cleanup to locate and delete the previous avatar file on local-storage deployments.

Because the stored avatarUrl is not sanitized or confined to the intended avatar directory, an attacker can supply a value containing path traversal sequences. When the cleanup routine processes the stored string, filesystem operations resolve outside the expected directory. The result is deletion of arbitrary files or directories writable by the Docmost service account.

The exploitation requires authentication but only low privileges, and no user interaction is needed. Confidentiality is not affected, but integrity impact is high and availability is affected due to loss of files critical to application or system operation.

Root Cause

The root cause is improper input validation of user-controlled filename and path data persisted through the avatarUrl field. The avatar cleanup logic trusts the stored value and uses it in filesystem operations without canonicalization or directory confinement checks, violating safe file handling practices described in [CWE-22].

Attack Vector

An authenticated attacker submits a crafted avatarUrl via the user update API. The value is persisted to the user record. When Docmost later executes avatar cleanup, it uses the attacker-supplied path to perform a delete operation, removing files outside the avatars directory.

typescript

// Patch excerpt — apps/server/src/core/user/dto/update-user.dto.ts
 export class UpdateUserDto extends PartialType(
   OmitType(CreateUserDto, ['password'] as const),
 ) {
-  @IsOptional()
-  @IsString()
-  avatarUrl: string;
-
   @IsOptional()
   @IsBoolean()
   fullPageWidth: boolean;

typescript

// Patch excerpt — apps/server/src/core/attachment/attachment.controller.ts
 import { TokenService } from '../auth/services/token.service';
 import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
 import * as path from 'path';
+import { sanitize } from 'sanitize-filename-ts';
 import { AttachmentInfoDto, RemoveIconDto } from './dto/attachment.dto';

Source: GitHub Commit a573ace. The fix removes the client-controllable avatarUrl from the user update DTO and introduces filename sanitization via sanitize-filename-ts in the attachment controller.

Detection Methods for CVE-2026-48070

Indicators of Compromise

User records containing avatarUrl values with path traversal sequences such as ../, absolute paths, or references outside the configured avatars directory.
Unexpected file or directory deletions in paths owned by the Docmost service account that correlate with user profile update activity.
Application logs showing avatar cleanup operations targeting files outside the designated storage directory.

Detection Strategies

Audit the database for stored avatarUrl values that do not match the expected avatars path prefix or filename format.
Review HTTP request logs for PATCH/PUT requests to user update endpoints containing suspicious avatarUrl payloads with traversal characters.
Correlate filesystem deletion events on the Docmost host with avatar update API calls to identify anomalous cleanup activity.

Monitoring Recommendations

Enable filesystem auditing on directories accessible to the Docmost service account to capture unauthorized deletions.
Monitor Docmost application logs for file operations resolving outside the configured avatar storage directory.
Alert on authenticated API requests containing ../, URL-encoded traversal sequences, or absolute paths in profile-related fields.

How to Mitigate CVE-2026-48070

Immediate Actions Required

Upgrade Docmost to version 0.80.1 or later on all self-hosted deployments.
Audit existing user records for malicious avatarUrl values and sanitize or remove entries containing traversal sequences before upgrading.
Restrict filesystem permissions of the Docmost service account to the minimum directories required for operation.

Patch Information

The vulnerability is fixed in Docmost 0.80.1. The patch removes the avatarUrl field from UpdateUserDto, preventing clients from directly setting the stored value, and introduces sanitize-filename-ts in the attachment controller to normalize filenames. See the GitHub Security Advisory GHSA-95f8-h5hf-8248 and the GitHub Release v0.80.1 for release details.

Workarounds

If immediate patching is not possible, run Docmost under a dedicated low-privilege service account with filesystem access limited strictly to the application's required directories.
Deploy a reverse proxy or WAF rule to block requests to user update endpoints containing path traversal patterns in JSON payload fields.
Consider using object storage backends instead of local storage to reduce the impact of filesystem-level deletion.

bash

# Upgrade Docmost (Docker example)
docker pull docmost/docmost:0.80.1
docker compose down
docker compose up -d

# Verify version
docker exec -it docmost cat package.json | grep version