Docat: Arbitrary file upload in Upload API
Summary
Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker who can reach the API can overwrite sensitive configuration files or place malicious files on the web server. Depending on the deployment, this can lead to remote code execution or cross-site scripting. Whether an attacker needs a login or API key in a default setup is unknown.
Affected
- docat (docat-org) versions before 1.6.0
Fixed in
- Version 1.6.0 mitigates filename-based path traversal (fix commit 85fc40e).
- Version 1.6.0 is not confirmed to fix the unrestricted file type issue or the deployment-dependent malicious content effects.
- Whether version 1.6.1 includes further fixes for this issue is unknown.
Workaround
- No vendor workaround is known.
- Generic hardening: restrict access to the Upload API to trusted internal networks or VPN, and run docat with a service account that cannot write to the web root or configuration paths.
Exploitation
- Not known to be exploited (OffSeq).
- VulDB rates it as a 0-day with no exploit available.
- No public proof of concept from a primary source was found.
- CISA KEV status is unverified.
Our recommendation
- Inventory all docat instances, including internal ones, and record their versions.
- Upgrade to version 1.6.0 or later, and check the latest release notes and the GitHub advisory for further fixes.
- Restrict the Upload API to trusted networks and do not expose it to the internet.
- Run docat with a minimal-privilege account that cannot write to the web root or configuration files.
- Review upload logs and the web root for unexpected non-HTML files.
- Monitor the NVD record and the GitHub advisory GHSA-jcxj-j5qf-8crw for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 85fc40e github.com
- docat release 1.6.0 github.com
- GitHub Security Advisory GHSA-jcxj-j5qf-8crw github.com
- VulDB CVE-2026-61645 vuldb.com
- VulDB 428790 vuldb.com
- TheHackerWire CVE-2026-61645 www.thehackerwire.com
- OffSeq Radar CVE-2026-61645 radar.offseq.com
- ThreatInt CVE-2026-61645 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:08.
Original description (NVD)
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.