The vulnerability allows an attacker to embed a JavaScript URI in a comment on any Docmost page. When a user clicks that link, the browser executes the JavaScript in the context of the Docmost site, enabling the attacker to run arbitrary code, steal session cookies, modify the page or perform actions as the victim. This is a classic reflected or stored XSS with the potential for phishing, credential theft, or downstream exploitation of other services.

The affected product is Docmost, an open‑source collaborative wiki and documentation platform. All releases prior to version 0.80.0 contain the flaw. The vendor is identified as docmost:docmost.

The CVSS score of 5.4 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited widespread exploitation to date. The likely attack vector is remote: any user who can leave a comment can inject the malicious link, and any other user who clicks the link triggers the payload. The risk is that internal users may be exposed if they click user‑inserted JavaScript URIs.