The vulnerability is a path traversal flaw in the avatar attachment handling code of Docmost version 0.21.0. An attacker can construct a POST request to a public endpoint and supply a file path containing traversal characters that causes the server to read arbitrary files from the local filesystem. Successful exploitation allows the disclosure of sensitive configuration files, source code, or any other file the server process can access, leading to a compromise of confidentiality.

Docmost 0.21.0 installed in any environment with the avatar upload endpoint exposed. The flaw exists in the core attachment controller where paths are not properly sanitised.

The flaw is exploitable without authentication over the network via a simple POST request to a public URL. No EPSS score is available, and the vulnerability is not yet listed in CISA KEV. Because it permits arbitrary local file reads, the risk of disclosure is high, and the potential impact could be severe if sensitive files are accessible.