{"id":"CVE-2025-57231","title":"Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.","summary":"Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"published":"2026-09-10","updated":"2026-09-22","sourceUpdated":"2026-09-22T20:00:03.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-57231","references":[{"url":"https://github.com/docmost/docmost/blob/0bd7ecb9b03a74e9a5e3f97b6457b82371c5ceb2/apps/server/src/core/attachment/attachment.controller.ts#L345","label":"cve@mitre.org"},{"url":"https://www.artresilia.com/docmost-v0-21-0-cve-2025-57231-unauthenticated-file-path-traversal/","label":"cve@mitre.org"},{"url":"https://www.artresilia.com/docmost-v0-21-0-cve-2025-57231-unauthenticated-file-path-traversal/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.0126,"epssPercentile":0.683,"exploits":{"github":1,"githubRepos":["https://github.com/anirbala98/CVE-2025-57231"],"nuclei":["CVE-2025-57231"],"checkedAt":"2026-09-22T20:10:49.857Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-11T17:52:19.567015Z"},"ingestedAt":"2026-09-14T00:35:28.535Z","slug":"CVE-2025-57231","body":"## Overview\n\nPath Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":93571,"id":"CVE-2025-57231","ts":1789152871139,"field":"exploit_available","old":"false","new":"true"},{"seq":93570,"id":"CVE-2025-57231","ts":1789152871139,"field":"cvss","old":null,"new":"7.5"},{"seq":93569,"id":"CVE-2025-57231","ts":1789152871139,"field":"severity","old":"none","new":"high"}]}