CVE-2025-57231Disclosure

MEDIUMCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.

5.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-22

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-14); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-14: 1Mentions · 2026-10-27: 1PoC Mentioned / Linked · 2026-10-27: 1Active Exploitation · 2026-10-27: 1Technical Details · 2026-09-14: 109-1410-27
Signal classification2 categories
Disclosure
150.0%
Active Exploitation
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-141
Disclosure1
2026-10-271
Active Exploitation1
Full discourse2 posts
  • ♫Why♥Not♪@Python_s_
    Active Exploitation

    NØØT Security Alerts Classification: Critical CVE: CVE-2025-57231 Product: Docmost Summary: VulnCheck reports real-world exploitation activity affecting docmost / Docmost. Evidence: Public PoC/exploit available; Active exploitation reported; Severe impact class; Live exploitation observed by VulnCheck canaries Impact: The vulnerability has a severe impact class such as code execution, authentication bypass, account takeover, or privilege escalation. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 25 Oct 2026 Source: https://vulncheck.com/xdb/b459f7eb629a #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #Docmost #CVE_2025_57231 #ActiveExploitation #Exploit

    Post summary

    The alert reports critical active exploitation of CVE-2025-57231 in Docmost, with public PoC available and live exploitation observed.

    0001070
    231 followersView on X
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2025-57231 - high 🚨 Docmost 0.2.1-0.21.0 - Arbitrary File Read > Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attac... 👾 https://cloud.projectdiscovery.io/library/CVE-2025-57231 @pdnuclei #NucleiTemplates #cve

    Post summary

    Tweet announces CVE-2025-57231 (Docmost path traversal → arbitrary file read) with a link to ProjectDiscovery's library; no PoC, exploit tool, patch, or active-exploitation evidence is provided.

    00000224
    1.3K followersView on X

Explore more