Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61645updated 29 Oct 2026, 22:17 UTC

Docat upload feature lets attackers place harmful files on the server

Docat has a file upload feature that does not check what files are accepted. An attacker could upload files that overwrite settings or run malicious code on the server.

Partial fixOfficial source
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?PartlyVersion 1.6.0 mitigates filename-based path traversal. Restrictions on unrestricted file types are not established by the verified patch. · since 29 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends fileUploads a crafted file via the Upload API
  2. 2No file checksUpload API does not validate path or file type
  3. 3File written to serverCan overwrite config or add malicious files
  4. 4Code or script runsDepends on deployment; may enable RCE or XSS
  5. ResultAttacker gains control or steals user cookies

What happened

The Docat Upload API does not validate uploaded file paths or file types, enabling arbitrary file upload that can overwrite sensitive configuration files or place malicious files on the web server.

Why it is dangerous: Depending on how Docat is deployed, this can lead to remote code execution on the server or cross-site scripting that steals cookies or redirects users to malicious sites.

Are you affected?

You are affected if you run Docat with its Upload API exposed, in versions before 1.6.0 (or any version without the fix for path traversal and unrestricted file types).

Docat, Upload API, versions prior to 1.6.0

What to do

  1. Update Docat to version 1.6.0 or later
  2. Restrict access to the Upload API to trusted users only
  3. Limit uploads to required file types and review files already uploaded to the server
  4. Review the server for unexpected or modified files and configuration changes

Timeline

  1. 29 Oct 2026, 22:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 22:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 22:17 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61645
CVSS
9.1 / 10
Disclosed
29 Oct 2026, 22:17 UTC
On Zero Radar
29 Oct 2026, 22:17 UTC (0 min after disclosure)
Last change
29 Oct 2026, 22:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Docat upload feature lets attackers place harmful files on the server · Zero Radar