Docmost, an open‑source collaborative wiki, has a path‑traversal flaw in its avatar cleanup routine. Authenticated low‑privileged users can store attacker‑controlled avatarUrl values. During cleanup, the application re‑uses these values without restricting them to the intended directory, allowing deletion of any file or directory reachable by the Docmost service account. The consequence is loss of data or service availability, as arbitrary local files can be permanently removed.

The vulnerability affects installations of Docmost prior to version 0.80.1. Any deployment using a local‑storage configuration where the service account has write permissions to the file system is susceptible. Users and administrators should verify the version they are running and plan a timely upgrade.

The CVSS score of 7.1 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation at this time. The exploit requires authenticated access to set a malformed avatarUrl; hence the attack vector is likely local with pre‑existing user credentials. If leveraged, an attacker could delete critical configuration or application files, leading to degradation of service and potential data loss.