CVE-2026-65827

Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service

State: Published
Severity: 6.5 Medium
Published: Sep 24, 2026
Updated: Sep 24, 2026
Reserved: Jul 22, 2026

Description

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
docmostdocmost	>= 0.21.0, < 0.95.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.