Docmost 0.2.1-0.21.0 - Arbitrary File Read
Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL.
PoC 已收录Docmost
CVSS7.5EPSS 1.8%