Security advisories provide information about security issues affecting Docmosis products, including affected versions, mitigations and available fixes.
SA-2026-001 — Docmosis Tornado
Published: 19 August 2026
Affected Versions: 2.11.3 and earlier.
Fixed in Versions: 2.11.4 and later.
A vulnerability affecting the storeTo=file:xxx option of the Tornado /render API may allow generated content to be written to unintended filesystem locations.
Security Advisory DSA-2026-001.pdf
