Docmost betroffen von Arbitrary File Write über Zip Import Feature (ZipSlip)

The Arbitrary File Write vulnerability in Docmost poses a significant risk. An attacker could exploit this flaw to upload malicious files, such as web shells, to the server. Successful exploitation could grant the attacker remote code execution, allowing them to compromise the entire Docmost instance and potentially the underlying server. The ability to write arbitrary files bypasses standard security controls and could lead to data breaches, system takeover, and denial of service. This vulnerability shares characteristics with other ZipSlip vulnerabilities where insufficient filename validation allows attackers to manipulate file paths.

Organizations using Docmost for internal documentation or collaboration, particularly those running vulnerable versions (0.21.0 - 0.23.9) on publicly accessible servers, are at significant risk. Shared hosting environments where multiple users have access to Docmost installations are also particularly vulnerable.

• nodejs: Monitor process execution for suspicious file creation or modification within the Docmost installation directory. Use ps aux | grep docmost to identify running processes and find /path/to/docmost -type f -mmin -60 to check for recently modified files. • generic web: Examine access logs for POST requests to the Zip Import endpoint with unusual file extensions or filenames. Use grep -i "zip import" /var/log/apache2/access.log to identify relevant requests. • generic web: Check response headers for errors related to file uploads or unexpected file content. Use curl -I <docmosturl>/zipimport to inspect headers.

1. 2026-01-15Disclosure

   disclosure

1. Reserviert2026-01-07
2. Veröffentlicht2026-01-15
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22249 is to upgrade Docmost to version 0.24.0 or later, which includes the necessary fix. If upgrading immediately is not possible, consider implementing temporary workarounds. Restrict file upload capabilities and carefully validate all user-supplied filenames before processing them. Implement a Web Application Firewall (WAF) with rules to block suspicious file uploads or requests targeting the Zip Import Feature. Monitor Docmost logs for unusual file creation or modification activity.