CVE-2026-22867

MEDIUM 5.4CVE-2026-22867 · Published 15/01/2026 · updated 17/06/2026

In short

CVE-2026-22867 is a MEDIUM (CVSS 5.4) vulnerability affecting docs (lasuite).
Chance of exploitation in the next 30 days (EPSS): 0.30%, higher than 22.7% of all vulnerabilities.
Fix: update to 4.3.0 or later.

Package	Affected versions	Patched versions
docs lasuite	`≥ 3.8.0, < 4.3.0`	`4.3.0`

Description

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacker with document editing privileges can inject a malicious javascript: URL that executes arbitrary code when other users click on the link. This vulnerability is fixed in 4.4.0.

References

suitenumerique/docs commit e807237 · Patch
suitenumerique/docs release v4.4.0 · Product
suitenumerique/docs security advisory · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free