CVE-2026-33193

BRIEFING NOTE - CVE-2026-33193 OVERVIEW Docmost versions prior to 0.70.0 contain a stored cross-site scripting (XSS) vulnerability resulting from improper handling of MIME type spoofing. This open-source collaborative wiki and documentation software flaw allows attackers to inject malicious scripts that persist in the application, potentially compromising user sessions and sensitive data accessed through the platform. SEVERITY The vulnerability carries a CVSS 3.1 base score of 4.6 (MEDIUM), reflecting a network-accessible attack vector with low complexity requiring low privileges and user interaction. The impact scope is unchanged, with potential for low confidentiality and integrity compromise, though no availability impact is expected. The exploit requires authenticated access and user interaction, which moderately constrains the threat landscape. EXPLOITATION STATUS This vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is currently classified as inactive on public hot lists. The EPSS score of 0.0001 indicates minimal real-world exploitation probability relative to the overall CVE population. No public exploit code has been identified in community channels. Organizations running Docmost should prioritize upgrading to version 0.70.0, which contains the security patch, though immediate remediation urgency is low based on current exploitation indicators.