Threat database

ONLYOFFICE DocumentServer versions from 2.5.0 up to but not including 10.0.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the /downloadfile/:docid endpoint. This flaw allows remote attackers to bypass private IP filtering when JWT verification is disabled, enabling them to make the server fetch and relay internal or cloud metadata content. The vulnerability arises due to the isInJwtToken flag being exploitable in the default configuration.

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.