CVE-2026-34212

Docmost page content has stored XSS via unsanitized attachment URLs

Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.

Affected

docmost

CVSS v3.1 GITHUB

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-04-14

Updated

2026-04-15

Proof-of-concept exploits (1)

• 0xmrma/CVE-2026-342120★ · 2026-06-26

Security advisories

• docmost/docmost/security/advisories/GHSA-cf68-cff9-hq4w

References

• CVE Record
• NVD entry

Related

• CVE-2026-14361
• CVE-2026-32722
• CVE-2026-33146
• CVE-2026-33936
• CVE-2026-34048
• CVE-2026-34207