CVE-2026-61645

Summary

Docat's Upload API allows unvalidated arbitrary file uploads, enabling attackers to overwrite sensitive configuration files or deploy malicious content such as scripts that lead to remote code execution or cross-site scripting, depending on server deployment.

Exploitability

Exploitation is straightforward for authenticated low-privilege users with network access; no user interaction or complex conditions are required.

Blast radius

Successful exploitation could compromise confidentiality, integrity, and availability of the Docat instance and potentially underlying systems if remote code execution is achieved in certain deployments.

Detection

Monitor for unexpected file creation or modification in configuration directories (e.g., /etc/docat/, config.yaml), unusual HTTP 200 responses to POST requests on the upload endpoint with non-standard file extensions, or deployment of files outside expected static documentation trees.

Prioritized remediation

Upgrade to Docat version 1.6.0 or later, which mitigates filename-based path traversal; however, since unrestricted file types remain unpatched, immediately restrict allowed upload content types (e.g., only permit .html, .css, .js with strict MIME-type enforcement) and sanitize or reject all non-static-document paths.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.