Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites.

Affected is the Docat application developed by docat-org. No specific version numbers are indicated in this CVE, although release 1.6.0 contains mitigation for filename-based path traversal; the patch does not remove unrestricted file types or other deployment‑dependent effects. Administrators should therefore verify that they are running a patched version that addresses the path traversal flaw and consider additional safeguards.

The CVSS score of 9.1 classifies this as a high‑severity flaw. Since the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the precise exploitation probability remains uncertain, but the vulnerability is publicly documented and the path traversal can be triggered via the web API. The likely attack vector is remote over HTTP(S); if the Upload API is exposed, an attacker could exploit it without additional credentials. The existence of an official patch suggests that organizations should prioritize remediation.