CVE-2025-57231

Docmost v0.21.0 contains a path traversal flaw (CWE-22) in its handling of avatar attachments. An unauthenticated attacker can send a crafted POST request to a publicly reachable URL, causing the application to read files from outside the intended directory on the server. Successful exploitation discloses arbitrary local files — potentially including configuration files, secrets, or environment variables — with no impact on integrity or availability (CVSS 3.1: 7.5, High, C:H/I:N/A:N). Any deployment running Docmost v0.21.0 is affected, with risk concentrated on instances exposed to the public internet. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so exploitation has not been confirmed, though the network-reachable, unauthenticated nature makes opportunistic scanning plausible once details circulate.

What to do: Upgrade Docmost to a release newer than v0.21.0 as soon as a patched version is published, and watch the project's official GitHub repository or release notes for the fix. In the meantime, restrict network access to exposed instances (firewall rules, reverse-proxy allowlists, or VPN-only access) and inspect access logs for suspicious POST requests to avatar-attachment endpoints containing traversal sequences (e.g., ../) that indicate attempted file reads. Because the flaw only exposes files, prioritize identifying what sensitive data (credentials, keys) is stored on affected hosts in case compromise must be assumed.