The flaw lies in the page‑import feature’s ZIP extraction process. An authenticated workspace member with edit rights can upload an archive up to 200 MB in size, but the extractor expands each entry without limiting total uncompressed size, per‑entry size, or the number of entries. When the archive contains a nested ZIP, the outer file can expand by several gigabytes, exhausting the server’s temporary directory, crashing the import worker, and potentially bringing down the entire instance, affecting every tenant.

Docmost, the open‑source collaborative wiki and documentation platform, is affected in releases 0.21.0 through 0.94.9 (inclusive). The issue is fixed starting with version 0.95.0, which enforces extraction limits. Users running any of the affected versions are therefore vulnerable.

The CVSS score of 6.5 indicates moderate severity, and although the EPSS score is not available, an attacker only needs legitimate edit credentials to trigger the vulnerability. This scenario makes the risk significant in environments where many users have edit privileges. The vulnerability is not listed in the CISA KEV catalog, and exploitation requires simple authentication rather than remote code execution.