CVE-2026-34212
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Docmost prior to 0.71.0, improper neutralization of attachment URLs allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node. When another user views the page and activates the link, attacker-controlled JavaScript executes in the Docmost context.
Risk Assessment
An attacker can execute arbitrary scripts in the victim's browser, potentially leading to session theft, data leakage, or other actions on the victim's account.
Recommendation
Update Docmost to version 0.71.0 or later.
Original NVD description (English source)
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.