CVE-2026-48073

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48073
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48073.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-48073
Aliases
  • GHSA-rxm9-xp9h-4c84
Published
2026-09-24T18:33:20Z
Modified
2026-09-25T03:46:06Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Docmost: Page export can include restricted same-space attachments through forged attachmentId
Details

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48073.json"
}
References

Affected packages

Git / github.com/docmost/docmost

Affected ranges

Type
GIT
Repo
https://github.com/docmost/docmost
Events
Introduced
37355452e11958bcd98c1588fe3ece227e983e46
Fixed
980521f95792ddd382ebbc275467a8319a351bae
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.70.0"
        },
        {
            "fixed": "0.80.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.70.0
v0.70.1
v0.70.2
v0.70.3
v0.71.0
v0.71.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48073.json"