Live › vulnerability › CVE-2026-61645
Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker can overwrite sensitive configuration files or place malicious files on the web server, which can enable remote code execution or cross-site scripting depending on the deployment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 22:27 UTC. All times on this page are UTC.
Teams that self-host Docat and expose its Upload API to users or networks they do not fully trust are exposed. The sources say remote code execution depends on the deployment context. Teams that do not run Docat, or keep the Upload API off untrusted networks, can skip it, though the sources do not say how the upload endpoint is normally exposed.
No product ranges from the sources yet.
docat --version or the version in your deployment config (unknown if the sources name a different command)1.6.0 mitigates filename-based path traversal; the sources state that unrestricted file types are not addressed by the verified patchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-61645")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.