Docmost is an open‑source wiki that allows users to attach files to page content. A low‑privileged authenticated user can embed a javascript: URL inside an attachment node. When any user opens the attachment link, the browser executes the attacker’s code in the Docmost origin. The result is client‑side script execution that can steal session cookies, modify displayed content, or perform actions on behalf of the victim. The weakness identified is reflected input leading to stored XSS (CWE‑79).

The vulnerability exists in all Docmost releases older than 0.71.0, the earliest affected version being 0.70.x. All documented users of these older releases who allow authenticated users to add attachment nodes are impacted.

The CVSS score of 5.4 indicates moderate severity. Because the flaw requires authentication, only users who can log in to the application are required to launch the exploit. No network exploitation is necessary; the patch has been released and is not listed as a known exploited vulnerability. Without an applied fix, attackers can embed malicious URLs and cause arbitrary code execution when other users view affected pages. The overall risk remains moderate until the affected software is updated.