Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2026-24045

Docmost Affected by Stored XSS in Public Share Page
Back to all
CVE

CVE-2026-24045

Docmost Affected by Stored XSS in Public Share Page

Docmost is open-source collaborative wiki and documentation software. From g and before 0.25.0, the public share page functionality in Docmost does not properly HTML-escape page titles before inserting them into meta tags and the title tag. This allows Stored Cross-Site Scripting (XSS) attacks, where an attacker can execute arbitrary JavaScript in the context of any user who opens a shared page link. This vulnerability is fixed in 0.25.0.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
7.3
-
3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
C
H
U
-

Related Resources

No items found.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24045.json, https://github.com/docmost/docmost/commit/f3f74c591f32f85b8aa9a98ed884a7dd455780f9, https://github.com/docmost/docmost/releases/tag/v0.25.0, https://github.com/docmost/docmost/security/advisories/GHSA-h7fp-4f37-29wq, https://nvd.nist.gov/vuln/detail/CVE-2026-24045

Severity

7.3

CVSS Score
0
10

Basic Information

Ecosystem
Base CVSS
7.3
EPSS Probability
0.00031%
EPSS Percentile
0.08605%
Introduced Version
de5f90309c5dd3e0615bab3a3ec910422967609e
Fix Available
08e94eb3c11fda8380932762721155444e0e13fe

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading