High · published February 10, 2026
⚡ The public share page in Docmost has a sneaky flaw that lets attackers sneak in malicious JavaScript—no magic wand needed! 🪄 Think of it like a restaurant menu that doesn't check for allergens; one unsuspecting diner could be served a dish that triggers a dangerous reaction. Here, the meta tags are the menu, and without proper filtering, an attacker can serve up harmful content to any user who opens the shared link. An attacker could plant their JavaScript in shared page titles, executing it as soon as a user accesses that link. This could lead to stolen credentials, session hijacking, or even full control of the user's account—yikes! It's a high-risk scenario for any collaborative workspace.
Think of it like a restaurant menu that doesn't check for allergens; one unsuspecting diner could be served a dish that triggers a dangerous reaction. Here, the meta tags are the menu, and without proper filtering, an attacker can serve up harmful content to any user who opens the shared link. This Stored Cross-Site Scripting (XSS) vulnerability arises because the page titles are not HTML-escaped, allowing attackers to inject scripts that execute in the context of the user's session when they access a shared page.
An attacker could plant their JavaScript in shared page titles, executing it as soon as a user accesses that link. This could lead to stolen credentials, session hijacking, or even full control of the user's account—yikes! It's a high-risk scenario for any collaborative workspace. To protect your users, upgrade Docmost to version 0.25.0 immediately. Additionally, consider auditing your HTML escaping practices to ensure that all user input is properly handled to prevent similar vulnerabilities in the future. You've got this! Follow these steps and you'll keep your documentation environment secure and your team safe! 🛡️