What is GHSA-59m3-fj8c-996g?

GHSA-59m3-fj8c-996g is a security advisory published by GitHub Security Advisories with High severity. Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor...

Which CVE IDs does GHSA-59m3-fj8c-996g cover?

GHSA-59m3-fj8c-996g covers the following CVE IDs: CVE-2025-57231. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-59m3-fj8c-996g?

GHSA-59m3-fj8c-996g has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-59m3-fj8c-996gHighCVSS 7.5

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2025-57231 →

📋 Description

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-57231
https://github.com/docmost/docmost/blob/0bd7ecb9b03a74e9a5e3f97b6457b82371c5ceb2/apps/server/src/core/attachment/attachment.controller.ts#L345
https://www.artresilia.com/docmost-v0-21-0-cve-2025-57231-unauthenticated-file-path-traversal
https://github.com/advisories/GHSA-59m3-fj8c-996g