CVE Catalog
CVE-2026-33193
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk0.19%
9th percentile - higher than 9% of all known CVEs
Summary
Docmost prior to 0.70.0 is vulnerable to XSS via MIME type spoofing. An attacker can inject malicious script that executes in the victim's browser.
Risk Assessment
Risk of user account takeover, data theft, or malware propagation within the organization.
Recommendation
Update Docmost to version 0.70.0 or later, which contains the fix (GHSL-2026-052).
Original NVD description (English source)
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.