{"id":"CVE-2026-61645","kind":"vulnerability","aliases":["CVE-2026-61645"],"related":[],"title":"Docat: upload API lets attackers write arbitrary files to the server","description":"Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.","summary":"Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker can overwrite sensitive configuration files or place malicious files on the web server, which can enable remote code execution or cross-site scripting depending on the deployment.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docat","documentation","package","self-hosted"],"not_affected_if":["no-docat-deployment","upload-api-not-exposed"],"how_to_check":"- Check the installed Docat version against the fixed version (1.6.0 per the sources), for example with `docat --version` or the version in your deployment config (unknown if the sources name a different command)\n- Confirm whether the Upload API is reachable from untrusted networks (unknown if the sources give no detail)","fix":"- Docat: `1.6.0` mitigates filename-based path traversal; the sources state that unrestricted file types are not addressed by the verified patch","status":"open","published_at":"2026-10-29T22:17:04+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","triaged_at":"2026-10-29T22:28:38+00:00","updated_at":"2026-10-29T22:28:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T22:28:38Z","model":"claude-haiku-5-5","output":{"fix":"- Docat: `1.6.0` mitigates filename-based path traversal; the sources state that unrestricted file types are not addressed by the verified patch","reach":"internet","title":"Docat: upload API lets attackers write arbitrary files to the server","impact":"high","summary":"Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker can overwrite sensitive configuration files or place malicious files on the web server, which can enable remote code execution or cross-site scripting depending on the deployment.","audience":"businesses","category":"package","nicknames":[],"who_cares":["docat","self-hosted","documentation"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker overwrites config files and may run code on the server","analyst_note":"Check the NVD entry and the Docat repository for whether the fix covers unrestricted file types and whether upload auth is required.","how_to_check":"- Check the installed Docat version against the fixed version (1.6.0 per the sources), for example with `docat --version` or the version in your deployment config (unknown if the sources name a different command)\n- Confirm whether the Upload API is reachable from untrusted networks (unknown if the sources give no detail)","plain_action":"","needs_analyst":true,"not_affected_if":["no-docat-deployment","upload-api-not-exposed"],"who_is_affected":"Teams that self-host Docat and expose its Upload API to users or networks they do not fully trust are exposed. The sources say remote code execution depends on the deployment context. Teams that do not run Docat, or keep the Upload API off untrusted networks, can skip it, though the sources do not say how the upload endpoint is normally exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00074,"input_tokens":4215,"output_tokens":637,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61645':14A,17A '1.6.0':154C 'affect':87C 'api':3A,45B,97C,101C 'arbitrari':7A,90C 'aris':98C 'attack':5A,47B,112C 'base':158C 'code':65B,136C 'configur':51B,116C 'content':132C,172C 'context':130C 'cooki':146C 'cross':69B,140C 'cross-sit':68B,139C 'cve':12A,15A 'depend':72B,127C,169C 'deploy':75B,129C,168C 'deployment-depend':167C 'docat':1A,18B,24B,76C,124C 'document':19B,31B,84C 'effect':173C 'enabl':63B,134C 'establish':176C 'execut':66B,137C 'file':8A,40B,52B,56B,91C,107C,117C,121C,164C 'filenam':157C 'filename-bas':156C 'host':23B,28B,81C 'implement':88C 'intend':143C 'let':4A 'malici':55B,120C,151C,171C 'malicious-cont':170C 'mitig':155C 'overwrit':49B,114C 'packag':20B 'patch':180C 'path':36B,108C,159C 'place':54B,119C 'redirect':148C 'remedi':161C 'remot':64B,135C 'script':71B,142C 'self':22B 'self-host':21B 'sensit':50B,115C 'sent':41B 'server':11A,60B,126C 'site':70B,141C 'static':30B,83C 'steal':145C 'tool':26B,79C 'travers':160C 'type':38B,110C,165C 'unrestrict':163C 'upload':2A,44B,92C,96C,106C,131C 'user':149C 'valid':34B,104C 'verifi':179C 'version':29B,82C,153C 'vulner':93C 'web':59B,125C 'websit':152C 'write':6A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Docat and expose its Upload API to users or networks they do not fully trust are exposed. The sources say remote code execution depends on the deployment context. Teams that do not run Docat, or keep the Upload API off untrusted networks, can skip it, though the sources do not say how the upload endpoint is normally exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T22:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61645","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61645","severity":null,"published_at":"2026-10-29T22:17:04+00:00","modified_at":"2026-10-29T22:17:04+00:00","first_seen_at":"2026-10-29T22:27:06+00:00","fetched_at":"2026-10-29T22:27:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}