Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61645— Docat has Arbitrary File Upload exists in Upload API

Quick assessment

Affected
docat-org docat
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Docat 是一个用于托管版本化静态文档的工具。在受影响的实现中，由于 未对上传文件的路径或类型进行验证，导致存在任意文件上传漏洞。攻击者可以利用该漏洞覆盖敏感配置文件，或在 Docat Web 服务器上放置恶意文件。根据部署环境的不同，上传的内容可能引发远程代码执行（RCE），或导致跨站脚本（XSS）攻击，从而窃取用户 Cookie 或将用户重定向至恶意网站。 版本 1.6.0 已修复了基于文件名的路径遍历问题；但经核实的补丁尚未解决无限制文件类型上传的问题，也未明确消除因部署环境差异而可能引发的恶意内容利用风险

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61645

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Docat has Arbitrary File Upload exists in Upload API
Source: CVE Program / CVE List V5
Vulnerability Description
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
docat-org docat < 1.6.0 -

II. Public POCs for CVE-2026-61645

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61645

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61645 (1)

Vendor Advisories for CVE-2026-61645 (1)

Vendor Pages for CVE-2026-61645 (1)

IV. Related Vulnerabilities

Same weakness: CWE-434