CVE-2026-22249

CVE-2026-22249 is a critical arbitrary file write vulnerability (ZipSlip) affecting Docmost, an open-source collaborative wiki and documentation software, in versions 0.21.0 through 0.23.x. This flaw, stemming from a lack of filename validation during zip imports, allows unauthenticated attackers to write files to arbitrary locations on the server. With a CVSS score of 9.8, the vulnerability has a network attack vector, low complexity, and can lead to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or significant community discussion, the high severity warrants immediate patching to version 0.24.0 or later.