Docmost, an open‑source wiki, contains a stored cross‑site scripting flaw in its public share page function. Page titles are inserted into meta and title tags without proper HTML escaping. An attacker who creates or modifies a shared page can embed malicious JavaScript in the title, which will execute in the browser of any user who later opens that link. The vulnerable code allows arbitrary code execution in the context of legitimately logged‑in or anonymous users, exposing all data that the browser can access.

The vulnerability affects Docmost versions 0.20.0 up to, but not including, 0.25.0. Earlier releases are unaffected, and any deployment running 0.25.0 or newer has the fix in place. It is a single product—Docmost—distributed under the open‑source license.

With a CVSS score of 7.3, the flaw is considered a high‑severity risk. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack vector is remote and the flaw is stored, an attacker can embed a malicious title in a share link that anyone with access to that link can trigger, leading to potential data theft or session hijacking. The risk is moderate to high depending on user exposure to public share links.