Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33193: Docmost permits hidden script injection via file type trick

CVE-2026-33193 · published 6 months ago

Summary

Versions of the Docmost wiki before 0.70.0 let a malicious user store content that pretends to be a safe file type, but actually runs harmful code when viewed. This could let an attacker run scripts in the browsers of anyone who opens the forged page, risking data theft or site misuse. Upgrade to version 0.70.0 or later to fix the issue.

Original advisory text

Docmost vulnerable to stored XSS via MIME type spoofing

Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling of MIME type spoofing (GHSL-2026-052). An attacker could exploit this flaw to inject malicious scripts, potentially compromising the security of users and data. Version 0.70.0 contains a patch.

References

https://github.com/docmost/docmost/security/advisories/GHSA-7cq4-577p-wp6p Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33193... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33193 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.6 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published14 Apr 2026

Updated30 Oct 2026

First seen14 Apr 2026

Sources

CVE-2026-33193 · NVD

CVE-2026-33193 · OSV

GHSA-7cq4-577p-wp6p · GHSA

Track software like this

Free during beta