CVE-2026-65827 in Docmost
Summary
by MITRE • 09/24/2026
Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Docmost, a collaborative wiki and documentation platform, represents a critical resource management failure within its page-import functionality. Specifically affecting versions from 0.21.0 through 0.95.0, this flaw allows any authenticated workspace member possessing edit rights to trigger a denial of service condition by exploiting the ZIP extraction routine. The core technical deficiency lies in the absence of constraints on three critical parameters during archive processing: total uncompressed size, individual entry size, and the total count of entries within an uploaded archive. By leveraging these unchecked limits, an attacker can construct a maliciously crafted ZIP file that appears to comply with standard upload restrictions but expands significantly upon extraction.
The operational mechanism of this exploit relies on the server's temporary directory handling during the import process. When a user uploads an archive via the page-import feature, the system extracts its contents into a transient storage location without validating the cumulative size of the extracted files or limiting the number of entries processed. Furthermore, the extractor is designed to automatically decompress nested ZIP archives, creating a recursive extraction scenario that amplifies the resource consumption exponentially. An attacker can upload an outer archive within the default 200 MB limit, which contains inner layers of compression and high-ratio data structures such as zip bombs. Upon processing, this single file can expand into multiple gigabytes of uncompressed data, rapidly consuming available disk space on the server hosting the Docmost instance.
The impact of this vulnerability is severe, leading to immediate resource exhaustion that disrupts service availability for all tenants sharing the infrastructure. As the temporary directory fills up with excessive extracted files, the import worker process crashes due to insufficient storage resources or operating system limits. This crash not only halts the specific import operation but can also degrade overall instance performance by consuming CPU and memory resources during the failed extraction attempts. In worst-case scenarios, the disk exhaustion causes a complete service outage, rendering the platform inaccessible to legitimate users until administrative intervention clears the temporary files and restarts affected services.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, as well as CWE-770, specifically allocation of resources without limits. From an offensive security perspective, this attack vector corresponds to MITRE ATT&CK technique T1496, Resource Hijacking, where attackers consume computational or storage resources to disrupt service availability. The lack of input validation regarding archive complexity and expansion ratios is a common oversight in document processing libraries that prioritize convenience over strict resource governance.
Mitigation strategies must focus on implementing robust limits within the extraction logic. Administrators should ensure they have upgraded to version 0.95.0 or later, where these constraints are enforced. For environments running older versions, immediate remediation involves configuring the underlying ZIP library to enforce maximum uncompressed size thresholds and limiting the depth of nested archive processing. Additionally, implementing rate limits on upload frequency and monitoring disk usage alerts can provide early detection of such abuse patterns until a permanent patch is applied.