CVE-2026-22249 is a high severity arbitrary file write (CVSS 7.1) in the zip import feature of Docmost, the open source wiki. It affects 0.21.0 up to before 0.24.0 and is known as Zip Slip. The fix is Docmost 0.24.0, so upgrade and limit who can import.
What's affected
Docmost from 0.21.0 to before 0.24.0. The fixed version is 0.24.0.
The vulnerable code is in apps/server/src/integrations/import/utils/file.utils.ts, where file names inside an uploaded zip are not validated. The vector requires a low privilege account.
How to check if you're exposed
Find your Docmost version from your container image tag or the package version.
docker ps --format "table Names\tImage" | grep -i docmost
If the tag is between 0.21.0 and 0.23.x, you are affected. Then check who has permission to use the zip import feature.
What to do now
- Upgrade Docmost to 0.24.0 or later and restart the service.
- Review which users can import zip files, and reduce that to people who need it.
- Run the Docmost container as a non root user with a read only filesystem where you can.
- Check the application and temp directories for files you do not recognise.
- Add Docmost to your dependency inventory and enable alerts for new advisories.
Why it matters
The weakness is CWE-22, path traversal. A zip archive can hold entries whose names include parent directory markers. If the extractor joins those names to its target folder without checking the result, a file lands outside the folder. That is the Zip Slip pattern.
The advisory says the impact is that an attacker can create or overwrite files on the filesystem, and that in a web application this could replace application files and lead to code execution or take the app down. The base score is 7.1 because a low privilege account is needed and the vector rates integrity impact as low and availability as high.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list. The fix is to resolve each entry path and reject any that leave the destination.
Try it yourself
An inventory is how you answer which of your services run an affected version. Walk through one here.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to exploit this?
The vector says low privileges are required, so an attacker needs an account that can use the import feature.
What does Zip Slip mean?
Archive entries with path tricks that make extraction write outside the intended folder. Extractors must check the final path.
Sources
Last reviewed: 19 October 2026.
