CVE-2026-107781: Server-Side Request Forgery (SSRF) in dromara skyeye
Description
CVE-2026-107781 is a critical server-side request forgery (SSRF) and missing authorization vulnerability in Dromara Skyeye. It affects the OnlyOffice save callback function editUploadOfficeFileById, allowing unauthenticated attackers to supply arbitrary URL and key parameters. This enables attackers to make the server fetch internal URLs, overwrite any user's stored file, and read the results via queryFileToShowById.
CVSS v4.0
Score 9.1critical
Affected software
dromara
skyeye
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById. The CVSS 4.0 score is 9.1, indicating critical severity with network attack vector, high attack complexity, and no privileges or user interaction required.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to force the server to make requests to internal URLs, potentially accessing internal services. Additionally, the attacker can overwrite any user's stored file and read the results, leading to unauthorized data modification and disclosure.
Mitigation Recommendations
No patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-08T20:02:31.075Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac7feea2cdf04f656318bdc
Added to database: 10/08/2026, 20:36:58 UTC
Last enriched: 10/08/2026, 21:18:34 UTC
Last updated: 10/08/2026, 21:18:34 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.