Threat database

ONLYOFFICE DocumentServer versions from 2.5.0 up to but not including 10.0.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the /downloadfile/:docid endpoint. This flaw allows remote attackers to bypass private IP filtering when JWT verification is disabled, enabling them to make the server fetch and relay internal or cloud metadata content. The vulnerability arises due to the isInJwtToken flag being exploitable in the default configuration.

CVE-2026-110385 is a high-severity remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0. It allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary OS commands as the ds service account. The vulnerability arises from improper processing of user-controlled converter XML in the Document Builder API, enabling path override and arbitrary file write outside the job directory. This can lead to overwriting the runtime.json configuration file and modifying executable paths and arguments, resulting in command execution during subsequent Document Builder jobs.

ONLYOFFICE Docs Server has a path traversal vulnerability (CVE-2021-3199) that occurs when JSON Web Tokens (JWT) are used. The flaw involves a /.. sequence in an image upload parameter, which could allow an attacker to execute remote code on the server. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2025-68936 is a medium severity Cross-site Scripting (XSS) vulnerability in ONLYOFFICE Document Server versions before 9.2.1. The flaw arises from improper neutralization of input in the Color theme name, allowing an attacker with low privileges to inject malicious scripts without user interaction. Exploitation can lead to partial compromise of confidentiality and integrity, but does not affect availability. There are no known exploits in the wild yet. European organizations using ONLYOFFICE Document Server should prioritize patching to prevent potential targeted attacks. Countries with higher adoption of ONLYOFFICE and significant document collaboration needs are at greater risk. Mitigation involves applying updates once available, restricting access to the Document Server, and implementing web application firewalls with XSS protections. This vulnerability requires low complexity to exploit but limited privileges, making it a moderate risk that should be addressed promptly.

EPSS 0.2%VulnerabilityONLYOFFICE#cwe-79Germany+7

CVE-2025-68935 is a medium severity cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server versions before 9.2.1. The flaw arises from improper input neutralization in the Font field of the Multilevel list settings window, allowing an attacker with low privileges to inject malicious scripts without user interaction. Exploitation can lead to partial compromise of confidentiality and integrity, with no direct impact on availability. The vulnerability affects web-based document collaboration environments and could be leveraged for session hijacking or data theft. No known exploits are currently reported in the wild. European organizations using ONLYOFFICE Document Server should prioritize patching once updates are available and implement strict input validation and content security policies. Countries with higher adoption of ONLYOFFICE, such as Germany, France, and the UK, are more likely to be impacted. Given the CVSS score of 6.

EPSS 0.2%VulnerabilityONLYOFFICE#cwe-79Germany+5

ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.

EPSS 0.2%VulnerabilityONLYOFFICE#cwe-79Germany+6

The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment ID maps to an existing attachment post, but does not verify the requester’s identity or capabilities. This makes it possible for unauthenticated attackers to log in as an arbitrary user.

EPSS 0.8%Vulnerabilityonlyoffice#cwe-862United States+9

ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.

EPSS 62%VulnerabilityOnlyOffice#cwe-79Germany+9

The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.