Description

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-10T22:16:54.070Z",
  "pubdate": "2026-09-10T22:16:54.070Z",
  "executiveSummary": "Docmost version 0.21.0 contains a critical path traversal vulnerability within its avatar attachment processing functionality.\nThis flaw allows unauthenticated remote actors to bypass file system restrictions and read arbitrary files from the host server's local file system.\nThe vulnerability originates from improper validation of user-supplied input during the avatar upload or retrieval process, leading to unauthorized file disclosure.\nBy manipulating specific parameters in a POST request, an attacker can traverse directory structures outside the intended storage directory.\nThe impact includes the exposure of sensitive configuration files, environment variables, credentials, and source code, potentially leading to full system compromise.\nThere are no authentication or privilege requirements to exploit this flaw, making the application highly susceptible to remote attacks from unauthenticated parties.\nOrganizations using Docmost v0.21.0 are at significant risk of information leakage, necessitating immediate defensive measures and monitoring for anomalous POST request patterns targeting avatar endpoints.",
  "technicalDetails": "The vulnerability resides in the Docmost avatar attachment handling logic, specifically within the subsystem responsible for processing and serving user-provided avatar images.\nThe root cause is an improper neutralization of special elements used in file path lookups, where the application fails to adequately sanitize or validate the file path input provided by the user before performing a file system operation.\nAn unauthenticated attacker can initiate a POST request toward the avatar endpoint, injecting sequences such as '../' into the path parameters.\nThe application backend, failing to implement sufficient directory-level enforcement or path normalization, resolves these traversal sequences relative to the application's root or attachment directory.\nStep-by-step exploitation involves identifying the vulnerable POST request structure that triggers avatar processing. The attacker replaces expected file identifiers with a crafted path, such as '..%2f..%2f..%2fetc%2fpasswd'.\nUpon receiving the request, the server-side logic concatenates this malicious input with a base directory path. Due to the lack of secure path canonicalization, the operating system's file system API resolves the path to sensitive files located outside the intended scope.\nThe server then reads the contents of the target file and improperly returns the content, effectively disclosing sensitive local information to the attacker through the HTTP response.\nThe scope of this vulnerability extends to any file the user process running the Docmost application has permission to access. This includes internal database configuration files containing credentials, system-level sensitive files, and application source code.\nBecause the vector is reachable via a public URL without requiring authenticated sessions, the attack surface is exposed to any network-accessible endpoint, including those on the open internet.\nThe exploitation does not necessarily require complex environmental conditions beyond the presence of the vulnerable avatar upload/processing route. Once the attacker successfully triggers the traversal, the leakage is immediate, providing the attacker with persistent insight into the host operating system's internal structure and security configuration."
}