docat-org vulnerabilities and threats

CVE-2026-61645 is an arbitrary file upload vulnerability in docat versions prior to 1.6.0. The Upload API does not validate the uploaded file path or type, allowing attackers to overwrite sensitive configuration files or place malicious files on the server. This can lead to remote code execution or cross-site scripting depending on deployment context. Version 1.6.0 fixes filename-based path traversal but does not fully address unrestricted file type uploads or all malicious content risks.