CVE-2026-48072: Docmost Path Traversal Vulnerability

CVE-2026-48072 Overview

Docmost is an open-source collaborative wiki and documentation platform. Versions prior to 0.80.1 contain a path traversal vulnerability [CWE-22] in the public avatar and logo image endpoint. The endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confining access to the intended image directory.

An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. The issue is fixed in version 0.80.1.

Critical Impact

Unauthenticated remote attackers can read arbitrary local storage files whose basename matches a UUID pattern, enabling disclosure of attachments and user-uploaded content outside the public image directory.

Affected Products

• Docmost versions prior to 0.80.1
• Deployments using the local storage driver for avatars, logos, and attachments
• Self-hosted Docmost instances exposing the public image endpoint

Discovery Timeline

• 2026-09-24 - CVE CVE-2026-48072 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-48072

Vulnerability Analysis

The vulnerability resides in the Docmost attachment controller that serves public avatar and logo images. The route accepts a fileName parameter supplied by the client and joins it with the local storage base directory before reading the file from disk. Because the input is not confined to the avatar or logo subdirectory, directory traversal sequences such as ../ resolve to paths elsewhere on local storage.

The endpoint performs a basename check that requires the final path segment to match a UUID format. This check does not prevent traversal; it only restricts which files can be returned. Any object stored under local storage whose filename is a UUID — including user-uploaded attachments stored by Docmost itself — becomes reachable without authentication.

The fix in version 0.80.1 introduces filename sanitization using the sanitize-filename package and removes the client-controlled avatarUrl field from the user update DTO. These changes strip traversal metacharacters before the path is resolved.

Root Cause

The root cause is improper neutralization of path traversal sequences in a user-controlled filename parameter. The controller trusted the fileName route parameter and relied solely on a basename UUID regex for validation, rather than normalizing the resolved path and asserting it falls within the intended image directory.

Attack Vector

An unauthenticated attacker crafts an HTTP GET request to the public avatar or logo endpoint with a fileName path containing traversal segments. The server resolves the path against local storage and returns the file contents if the final basename matches the UUID check. Exposure is limited to files whose basename is a UUID, which is the default naming scheme Docmost uses for stored attachments.

// Patch excerpt: apps/server/src/core/attachment/attachment.controller.ts
 import { TokenService } from '../auth/services/token.service';
 import { JwtAttachmentPayload, JwtType } from '../auth/dto/jwt-payload';
 import * as path from 'path';
+import { sanitize } from 'sanitize-filename-ts';
 import { AttachmentInfoDto, RemoveIconDto } from './dto/attachment.dto';
 import { PageAccessService } from '../page/page-access/page-access.service';
 import { AuditEvent, AuditResource } from '../../common/events/audit-events';
// Source: https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5

The follow-up refactor consolidates sanitization behavior:

// Patch excerpt: apps/server/src/common/helpers/utils.ts
 import * as path from 'path';
 import * as bcrypt from 'bcrypt';
-import { sanitize } from 'sanitize-filename-ts';
+import sanitize = require('sanitize-filename');
 import { FastifyRequest } from 'fastify';
 import { Readable, Transform } from 'stream';
// Source: https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97

The server also removes the client-settable avatarUrl field, closing a related write-side issue:

// Patch excerpt: apps/server/src/core/user/dto/update-user.dto.ts
 export class UpdateUserDto extends PartialType(
   OmitType(CreateUserDto, ['password'] as const),
 ) {
-  @IsOptional()
-  @IsString()
-  avatarUrl: string;
-
   @IsOptional()
   @IsBoolean()
   fullPageWidth: boolean;
// Source: https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5

Detection Methods for CVE-2026-48072

Indicators of Compromise

• HTTP requests to the Docmost avatar or logo endpoints containing ../, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in the fileName segment.
• Access log entries where the public image route returns non-image content types or unusually large response bodies.
• Repeated unauthenticated requests enumerating UUID-named objects outside the avatar and logo directories.

Detection Strategies

• Inspect reverse proxy and application logs for requests to avatar and logo routes with path traversal patterns in the URI.
• Alert on anomalous response sizes from image endpoints that normally return small avatar or logo payloads.
• Baseline the Docmost version in use and flag any instance running a release earlier than 0.80.1.

Monitoring Recommendations

• Enable verbose HTTP access logging on the Docmost server and forward logs to a centralized analytics platform for pattern matching.
• Deploy a web application firewall rule that blocks path traversal metacharacters in the fileName parameter of public image routes.
• Monitor file-read activity on the local storage directory for unexpected cross-directory access by the Docmost process.

How to Mitigate CVE-2026-48072

Immediate Actions Required

• Upgrade all Docmost deployments to version 0.80.1 or later as the primary remediation.
• Audit local storage directories to inventory UUID-named objects that could have been exposed to unauthenticated readers.
• Review HTTP access logs for traversal attempts against avatar and logo endpoints prior to patching.

Patch Information

The fix is released in Docmost 0.80.1. See the GitHub Release v0.80.1, the GitHub Security Advisory GHSA-9f58-29hm-mgp2, and the corrective commits a573ace and ec83fc8.

Workarounds

• Place a reverse proxy rule in front of Docmost that rejects requests to avatar and logo routes containing .., %2e%2e, or backslash sequences in the path.
• Restrict network exposure of the Docmost instance to trusted networks until the upgrade can be deployed.
• Where feasible, migrate attachment storage to an object storage backend (S3-compatible) so the vulnerable local storage resolution path is not exercised.

# Example NGINX location block to block traversal on public image routes
location ~* ^/api/attachments/img/(avatar|logo)/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e)") {
        return 400;
    }
    proxy_pass http://docmost_upstream;
}