CVE-2026-65827

Name of the Vulnerable Software and Affected Versions Docmost versions 0.21.0 through 0.94.0

Description An issue exists in the page-import feature where the ZIP extraction routine fails to limit the total uncompressed size, per-entry size, or entry count of uploaded archives. An authenticated workspace member with edit rights can upload a ZIP file within the 200 MB limit that expands into multiple gigabytes, including one level of nested ZIP extraction. This can lead to disk exhaustion, causing the import worker to crash and potentially degrading or disabling the instance for all tenants.

Recommendations Update to version 0.95.0.