Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious `javascript:` URL inside an attachment node in page content. When another user views the page and activates the attachment link/icon, attacker-controlled JavaScript executes in the context of the Docmost origin. Version 0.71.0 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34212 Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-… https://www.cve.org/CVERecord?id=CVE-2026-34212
Post summary
Older Docmost versions (pre‑0.71.0) have a vulnerability involving improper neutralization of attachment URLs, leading to a low‑privilege issue.
CVE-2026-34212 Stored Cross-Site Scripting via Malicious Attachment URLs in Docmost Below 0.71.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34212
Post summary
The text announces a stored XSS vulnerability (CVE‑2026‑34212) affecting Docmost versions below 0.71.0, providing only the basic technical description with no PoC, exploit, patch, or active exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | docmost | docmost | - | - | - |