CVE-2026-34212

CVE-2026-34212 is a stored cross-site scripting (XSS) vulnerability affecting Docmost, an open-source collaborative wiki and documentation platform, in versions prior to 0.71.0. The vulnerability stems from improper neutralization of attachment URLs, allowing low-privileged authenticated users to inject malicious javascript: URLs into attachment nodes within page content. When other users interact with the attachment link, the attacker's JavaScript executes within the Docmost origin, potentially compromising user sessions and data. The vulnerability carries a CVSS score of 5.4 (Medium severity) with a network-based attack vector, low attack complexity, and low privilege requirements. However, it requires user interaction (UI:R) to trigger and has limited impact scope, affecting only confidentiality and integrity with no availability impact. The EPSS score of 0.0001 indicates minimal exploitation prevalence across the threat landscape. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. The community attention and exploitation risk are minimal. Remediation is straightforward: users should upgrade to version 0.71.0 or later, which patches the issue.