CVE-2026-61645

    Dashboard / Vulnerabilities / CVE-2026-61645

    CVE-2026-61645

    Published: 29 Oct 2026Last Modified: 1 Nov 2026

    Summary: Docat has Arbitrary File Upload exists in Upload API

    Details: Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.

    References: https://github.com/docat-org/docat/releases/tag/1.6.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61645.json, https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw, https://nvd.nist.gov/vuln/detail/CVE-2026-61645, https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c1010a3929adc59b60e1cd2b87af2928444bf69c

    Affected versions

    1.5.4
    1.5.3
    1.5.2
    1.5.1
    1.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-61645 | CVE-DB