---
id: CVE-2026-61645
title: Docat has Arbitrary File Upload exists in Upload API
summary: >-
  Docat is a tool for hosting versioned static documentation. In the affected
  implementation, an arbitrary file upload vulnerability in the `Upload API`
  arises because the API does not validate the `uploaded file path or type`. An
  attacker…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-434
vendor: docat-org
product: docat
affected:
  - docat < 1.6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:20:45.317186Z'
published: '2026-10-29'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:59:29.551Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61645'
references:
  - url: 'https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw'
    label: 'https://github.com/docat-org/docat/security/advisories/GHSA-jcxj-j5qf-8crw'
  - url: >-
      https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd
    label: >-
      https://github.com/docat-org/docat/commit/85fc40e8348c6328f488395d03c779517a0913fd
  - url: 'https://github.com/docat-org/docat/releases/tag/1.6.0'
    label: 'https://github.com/docat-org/docat/releases/tag/1.6.0'
tags:
  - cve.org
epss: 0.0041
epssPercentile: 0.35533
ingestedAt: '2026-11-05T16:24:31.049Z'
---

## Overview

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.

## Affected

- `docat < 1.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.