Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the "Upload API" arises because the API does not validate the "uploaded file path or type". An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server. Depending on deployment context, uploaded content can enable remote code execution or cross-site scripting intended to steal cookies or redirect users to malicious websites. Version 1.6.0 mitigates filename-based path traversal; remediation of unrestricted file types or deployment-dependent malicious-content effects is not established by the verified patch.