CVE-2026-65827: Docmost ZIP Extraction DOS Vulnerability

CVE-2026-65827 Overview

CVE-2026-65827 is a resource exhaustion vulnerability [CWE-400] in Docmost, an open-source collaborative wiki and documentation platform. The flaw affects versions 0.21.0 through 0.94.x and is fixed in version 0.95.0. Any authenticated workspace member with edit rights to a space can abuse the page-import feature by uploading a crafted ZIP archive. The extraction routine fails to enforce limits on total uncompressed size, per-entry size, or entry count. The server also automatically extracts one level of nested ZIP, allowing a 200 MB upload to expand into multiple gigabytes on disk.

Critical Impact
Disk exhaustion crashes the import worker and can degrade or take down the Docmost instance for all tenants sharing the deployment.

Affected Products

Docmost versions 0.21.0 through 0.94.x
Self-hosted Docmost deployments using the page-import feature
Multi-tenant Docmost instances where any workspace member has edit rights

Discovery Timeline

2026-09-24 - CVE-2026-65827 published to NVD
2026-09-24 - Last updated in NVD database
v0.95.0 - Docmost releases patched version with size and entry limits

Technical Details for CVE-2026-65827

Vulnerability Analysis

The vulnerability is a classic ZIP bomb condition (also known as a decompression bomb) in the Docmost page-import workflow. The extractor accepts an outer archive within the default 200 MB upload limit, writes entries to the server temporary directory, and automatically unwraps one nested ZIP. Because no cumulative size budget, per-entry size cap, or entry-count ceiling is enforced, a small compressed archive can expand into gigabytes of extracted content.

An attacker with workspace edit rights can trigger this condition by submitting a single import request. The resulting I/O and disk pressure crashes the import worker. On shared deployments, disk exhaustion cascades to all co-resident tenants, producing a denial-of-service condition across the instance.

The EPSS score is 0.295%, reflecting low observed exploitation activity, but the attack is trivial for any authenticated collaborator.

Root Cause

The root cause lies in apps/server/src/integrations/import/utils/file.utils.ts, specifically in the extractZip function. The original implementation delegated to an internal extractor without passing a size budget. Nested ZIP unwrapping compounded the risk by doubling the attack surface for compression ratio abuse.

Attack Vector

Exploitation requires authenticated access with edit rights to any space. The attacker uploads a maliciously crafted ZIP (optionally containing a nested ZIP) through the page-import endpoint. The extractor consumes all available temp-directory disk space, halting the import worker and degrading the host.

typescript

// Source: https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7
// Security patch in apps/server/src/integrations/import/utils/file.utils.ts

const COMPRESSION_HEADROOM = 10;
const MIN_EXTRACTED_BYTES = 256 * 1024 * 1024;
const MAX_ENTRIES = 250_000;

type SizeBudget = { used: number; max: number };

export async function extractZip(
  source: string,
  target: string,
): Promise<void> {
  const { size: compressedSize } = await fs.promises.stat(source);
  const max = Math.max(
    compressedSize * COMPRESSION_HEADROOM,
    MIN_EXTRACTED_BYTES,
  );
  return extractZipInternal(source, target, true, { used: 0, max });
}

The patch introduces an explicit SizeBudget tracked across the extraction, caps entries at 250,000, and bounds expansion to roughly 10x the compressed size with a 256 MB floor.

Detection Methods for CVE-2026-65827

Indicators of Compromise

Rapid disk-space depletion on the Docmost application server, especially in the OS temp directory used by the import worker
Repeated or oversized ZIP uploads to the Docmost page-import endpoint from a single workspace member
Import worker process crashes or out-of-disk errors in Docmost server logs
Nested ZIP structures observed in upload artifacts prior to deletion

Detection Strategies

Monitor filesystem usage on the Docmost host and alert when the temp directory grows beyond expected import sizes
Inspect reverse-proxy or application logs for POST requests to the page-import endpoint with payloads near the 200 MB limit
Correlate authenticated user activity with abnormal import failures to identify abusive accounts

Monitoring Recommendations

Enable disk-utilization alerts at 70% and 85% thresholds on partitions hosting the temp directory
Forward Docmost application logs to a centralized log platform and alert on repeated import worker exits
Track upload size distributions per workspace member to baseline normal import behavior

How to Mitigate CVE-2026-65827

Immediate Actions Required

Upgrade Docmost to version 0.95.0 or later, which enforces compression ratio, entry count, and total-size limits
Audit workspace membership and revoke edit rights from accounts that do not require import privileges
Review recent import activity for oversized or nested ZIP uploads that may indicate prior abuse

Patch Information

The fix is included in Docmost v0.95.0. The relevant commit is 04110884b4e90a43cc5b337e063d0b7493be5da7. Full remediation details are published in the GitHub Security Advisory GHSA-frjw-66gr-799m and the Docmost v0.95.0 release notes.

Workarounds

Place a reverse proxy in front of Docmost and lower the maximum upload size well below the default 200 MB until upgrade is possible
Mount the temp directory on a dedicated filesystem with a hard quota to contain disk exhaustion to a single partition
Temporarily disable the page-import feature or restrict it to a limited administrator group through workspace permission policies

bash

# Example nginx reverse-proxy limit to constrain uploads before the extractor runs
server {
    client_max_body_size 20m;
    location /api/pages/import {
        proxy_pass http://docmost_upstream;
    }
}