An unauthenticated path traversal vulnerability in Docmost v0.21.0 poses a significant risk by allowing unauthorized access to sensitive local files on the host system.

This is a path traversal vulnerability located within the avatar attachment handling logic. It allows an unauthenticated attacker to bypass security controls and read arbitrary files from the server filesystem via a specifically crafted POST request.

The ability for an unauthenticated user to read sensitive files from the server can lead to the exposure of configuration files, credentials, or proprietary source code. Given the CVSS score of 7.5, this high-severity vulnerability represents a significant risk to data confidentiality and organizational integrity.

Immediate Action: Administrators should monitor vendor channels for an official security patch and apply it immediately upon release. If an update is not yet available, restrict access to the affected service using network-level controls.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting avatar or attachment endpoints, specifically looking for directory traversal sequences like dot-dot-slash patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block incoming requests containing directory traversal payloads directed at the Docmost application.

Public Exploit Available: Unknown.

Due to the high severity of this vulnerability and the existence of a proof-of-concept, users are urged to prioritize the security of their Docmost deployments. Until an official patch is provided, minimize exposure by isolating the instance from the public internet or applying strict access control lists to the affected endpoints.