CVE-2026-61645 Docat has Arbitrary File Upload exists in Upload API
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-61645?
CVE-2026-61645 is a critical vulnerability in docat-org docat, published on 29 Oct 2026.
Official description
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.
Weakness: CWE-434
Which versions are affected by CVE-2026-61645?
How do I fix CVE-2026-61645?
No fix has been published for CVE-2026-61645 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61645 being exploited?
There is no known exploitation of CVE-2026-61645 in the wild and no public exploit code.