The vulnerability is a stored cross‑site scripting flaw caused by Docmost’s improper handling of MIME type spoofing. An attacker can inject malicious JavaScript into the system, which will execute in the browsers of users who view the affected content. This could lead to theft of session cookies, execution of unauthorized actions, and wider compromise of the collaborative environment.

Docmost 0.69.x and earlier versions of the open‑source wiki and documentation platform. The fix is included in version 0.70.0. Users running older releases are vulnerable.

The CVSS score of 4.6 indicates a moderate risk, and the lack of an EPSS score or KEV listing means that exploitation is not known to be actively leveraged. The likely attack path involves an attacker with the ability to add or modify content, possibly through unauthenticated uploads, triggering the MIME type spoofing that stores malicious scripts. Once stored, the scripts run whenever other users view the content.