{"id":"CVE-2026-61645","published":"2026-10-29T22:17:04.963","lastModified":"2026-10-29T22:17:04.963","description":"Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd","tags":[]},{"url":"https://github.com/docat-org/docat/releases/tag/1.6.0","tags":[]},{"url":"https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw","tags":[]}],"exploitRefs":[{"url":"https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd","tags":[]},{"url":"https://github.com/docat-org/docat/releases/tag/1.6.0","tags":[]},{"url":"https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw","tags":[]}],"hasPoc":true,"ai":{"summary":"Docat's Upload API allows unvalidated arbitrary file uploads, enabling attackers to overwrite sensitive configuration files or deploy malicious content such as scripts that lead to remote code execution or cross-site scripting, depending on server deployment.","exploitability":"Exploitation is straightforward for authenticated low-privilege users with network access; no user interaction or complex conditions are required.","blast_radius":"Successful exploitation could compromise confidentiality, integrity, and availability of the Docat instance and potentially underlying systems if remote code execution is achieved in certain deployments.","remediation":"Upgrade to Docat version 1.6.0 or later, which mitigates filename-based path traversal; however, since unrestricted file types remain unpatched, immediately restrict allowed upload content types (e.g., only permit .html, .css, .js with strict MIME-type enforcement) and sanitize or reject all non-static-document paths.","detection":"Monitor for unexpected file creation or modification in configuration directories (e.g., /etc/docat/, config.yaml), unusual HTTP 200 responses to POST requests on the upload endpoint with non-standard file extensions, or deployment of files outside expected static documentation trees.","tags":["arbitrary-file-upload","path-traversal","web","rce","csrf"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:20:56.685Z"}}