Docmost's public avatar and logo image endpoints allow an attacker to supply a fileName path segment that is resolved against the server's local storage without sanitization. By including traversal sequences, the attacker can reference files outside the intended image directories. When the supplied basename matches the route's UUID pattern, the server returns the file contents, enabling an unauthenticated local file read. This CWE‑22 vulnerability exposes potential confidentiality compromise for any file on the server that satisfies the UUID check.

This flaw exists in all Docmost installations running versions prior to 0.80.1, which is the open‑source collaborative wiki platform. Users deploying older releases (e.g., 0.79.x, 0.80.0 and earlier) are susceptible whenever the avatar or logo endpoints are publicly accessible.

The CVSS score of 5.3 indicates a medium severity. Because the affected routes are publicly reachable and the attack does not require authentication, the risk of exploitation is significant if the system is exposed to the internet. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the basic path traversal nature means an attacker can craft an HTTP request to read sensitive files if the final basename matches the UUID pattern. The attacker’s main prerequisite is network access to the exposed endpoint; no additional credentials are needed.