CVE-2026-61645

Name of the Vulnerable Software and Affected Versions Docat versions prior to 1.6.0

Description An arbitrary file upload issue exists in the Upload API because the system fails to validate the uploaded file path or type. This allows authenticated users to overwrite sensitive configuration files or upload malicious files to the web server. Depending on the deployment, this can lead to remote code execution or cross-site scripting, which may be used to steal cookies or redirect users to malicious websites. While version 1.6.0 addresses filename-based path traversal, it does not fully remediate unrestricted file types or deployment-dependent effects of malicious content.

Recommendations Update to version 1.6.0. Restrict access to the Upload API to minimize the risk of exploitation.