---
id: "CVE-2026-61645"
kind: "vulnerability"
aliases: ["CVE-2026-61645"]
title: "Docat: upload API lets attackers write arbitrary files to the server"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["docat", "documentation", "package", "self-hosted"]
not_affected_if: ["no-docat-deployment", "upload-api-not-exposed"]
published_at: "2026-10-29T22:17:04+00:00"
first_seen_at: "2026-10-29T22:27:06+00:00"
updated_at: "2026-10-29T22:28:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61645", "first_seen_at": "2026-10-29T22:27:06+00:00"}]
---

# Docat: upload API lets attackers write arbitrary files to the server

Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker can overwrite sensitive configuration files or place malicious files on the web server, which can enable remote code execution or cross-site scripting depending on the deployment.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Docat version against the fixed version (1.6.0 per the sources), for example with `docat --version` or the version in your deployment config (unknown if the sources name a different command)
- Confirm whether the Upload API is reachable from untrusted networks (unknown if the sources give no detail)

## Fix

- Docat: `1.6.0` mitigates filename-based path traversal; the sources state that unrestricted file types are not addressed by the verified patch

## Timeline

- 2026-10-29T22:27:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61645

## From the sources

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_