{"id":"CVE-2026-61645","aliases":[],"cve":{"records":[{"id":"CVE-2026-61645","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T17:38:57.112Z","published":"2026-10-29T21:17:37.532Z","modified":"2026-10-30T15:59:29.551Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T21:17:37.532Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T15:59:29.551Z"}],"references":[{"url":"https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/docat-org/docat/releases/tag/1.6.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-434","description":"CWE-434: Unrestricted Upload of File with Dangerous Type","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T15:20:45.317186Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Docat has Arbitrary File Upload exists in Upload API","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.","score":9.1,"severity":"critical","published":"2026-10-29T21:17:37.532Z","modified":"2026-10-30T15:59:29.551Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"docat-org","name":"docat","platforms":[],"versions":[{"version":"< 1.6.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61645"}],"remediation":[],"references":["https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw","https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd","https://github.com/docat-org/docat/releases/tag/1.6.0"],"sources":[{"name":"CVE","id":"CVE-2026-61645","modified":"2026-10-30T15:59:29.551Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61645"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","score":9.1}],"sourceAffected":[],"observedAt":"2026-10-30T17:19:52.424Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T22:00:37.398Z","attemptedAt":"2026-10-29T22:00:37.398Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T22:00:35.995Z","attemptedAt":"2026-10-29T22:00:35.995Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T22:00:36.908Z","attemptedAt":"2026-10-29T22:00:36.908Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T22:00:36.255Z","attemptedAt":"2026-10-29T22:00:36.255Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113395","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113395","modified":"Oct 29, 2026, 9:17:37 PM","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","checkedAt":"2026-10-29T22:00:36.908Z"}],"aiSummary":{"text":"Docat versions less than 1.6.0 have an arbitrary file upload vulnerability in the Upload API due to lack of validation of uploaded file path or type. An attacker can potentially overwrite configuration files or upload malicious files. The impact depends on the deployment context.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T11:25:39.045Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-61645"}]}}