CVE-2026-34212

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34212", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-26T15:57:52.324Z", "datePublished": "2026-04-14T21:42:44.202Z", "dateUpdated": "2026-04-15T20:02:55.239Z"}, "containers": {"cna": {"title": "Docmost page content has stored XSS via unsanitized attachment URLs", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w"}], "affected": [{"vendor": "docmost", "product": "docmost", "versions": [{"version": "< 0.71.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T21:42:44.202Z"}, "descriptions": [{"lang": "en", "value": "Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue."}], "source": {"advisory": "GHSA-cf68-cff9-hq4w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T18:56:22.513458Z", "id": "CVE-2026-34212", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:02:55.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34212", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T18:56:22.513458Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T18:56:36.047Z"}}], "cna": {"title": "Docmost page content has stored XSS via unsanitized attachment URLs", "source": {"advisory": "GHSA-cf68-cff9-hq4w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "docmost", "product": "docmost", "versions": [{"status": "affected", "version": "< 0.71.0"}]}], "references": [{"url": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w", "name": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T21:42:44.202Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34212", "state": "PUBLISHED", "dateUpdated": "2026-04-15T20:02:55.239Z", "dateReserved": "2026-03-26T15:57:52.324Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T21:42:44.202Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "docmost", "vendor": "docmost", "versions": [{"status": "affected", "version": "< 0.71.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:docmost:docmost:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7902868-D52C-43E3-B8D5-AAA13F6D8DCE", "versionEndExcluding": "0.71.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue."}, {"lang": "es", "value": "Docmost es un software de wiki y documentaci\u00f3n colaborativo de c\u00f3digo abierto. En versiones anteriores a la 0.71.0, una neutralizaci\u00f3n incorrecta de las URL de adjuntos en Docmost permite a un usuario autenticado con bajos privilegios almacenar una URL maliciosa 'javascript:' dentro de un nodo de adjunto en el contenido de la p\u00e1gina. Cuando otro usuario ve la p\u00e1gina y activa el enlace/icono del adjunto, JavaScript controlado por el atacante se ejecuta en el contexto del origen de Docmost. La versi\u00f3n 0.71.0 corrige el problema."}], "id": "CVE-2026-34212", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34212", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T18:56:22.513458Z", "version": "2.0.3"}}]}, "published": "2026-04-14T22:16:31.020", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.71.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "docmost", "source": "cna", "vendor": "docmost"}, "product": "docmost", "vendor": "docmost"}], "analysis": {"en": {"generated_at": "2026-04-14T23:26:12.708022+00:00", "value": {"mitigation_remediation": ["Upgrade Docmost to version 0.71.0 or later, which removes the unsanitized attachment URL handling.", "If upgrade cannot be performed immediately, disable or restrict the ability of low\u2011privileged users to add attachments or edit page content.", "Implement a Content Security Policy that blocks execution of inline scripts and restricts the allowed source for URLs."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all Docmost releases older than 0.71.0, the earliest affected version being 0.70.x. All documented users of these older releases who allow authenticated users to add attachment nodes are impacted.", "description_and_impact": "Docmost is an open\u2011source wiki that allows users to attach files to page content. A low\u2011privileged authenticated user can embed a javascript: URL inside an attachment node. When any user opens the attachment link, the browser executes the attacker\u2019s code in the Docmost origin. The result is client\u2011side script execution that can steal session cookies, modify displayed content, or perform actions on behalf of the victim. The weakness identified is reflected input leading to stored XSS (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 5.4 indicates moderate severity. Because the flaw requires authentication, only users who can log in to the application are required to launch the exploit. No network exploitation is necessary; the patch has been released and is not listed as a known exploited vulnerability. Without an applied fix, attackers can embed malicious URLs and cause arbitrary code execution when other users view affected pages. The overall risk remains moderate until the affected software is updated."}}}}, "created": "2026-04-15T13:48:23.622123+00:00", "updated": "2026-04-15T14:31:57.032051+00:00", "vendors": ["docmost", "docmost$PRODUCT$docmost"]}