Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
48 results
Oct 14, 2026ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows rCVE-2026-110652 · Other software · ONLYOFFICE · reported by VulnCheckMedium 6.3
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
- Product
- DocumentServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to CVE-2026-110385 · Other software · ONLYOFFICE · reported by MITREHigh 8.7
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2026When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigCVE-2026-93643 · Email & office · Zimbra · reported by cve@rapid7.comCritical 9.8
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.
- Product
- Zimbra Collaboration Suite (ZCS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12.CVE-2026-84282 · Other software · Ascensio System SIA / OnlyOffice · reported by cret@cert.orgMedium 6.5
A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.
- Product
- ONLYOFFICE ownCloud integration plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration.CVE-2026-73576 · Email & office · Zimbra · reported by MITREMedium 6.3
In Zimbra Collaboration (ZCS) before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with the generated secret may be able to recover the JWT signing secret through offline brute-force, potentially enabling JWT forgery.
- Product
- Collaboration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Jul 16, 2026LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to expCVE-2025-45870 · Other software · reported by MITREMedium 6.5
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlogicaldoc.com
May 26, 2026An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1.CVE-2026-38587 · Other software · reported by MITREMedium 4.3
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. This allows authenticated users with low-level permissions (User or Guest) to retrieve sensitive information, such as the Owner's unique identifier (ID) and profile information, which should only be accessible to administrators.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leadingCVE-2026-41034 · Other software · Ascensio · reported by MITREMedium 5
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an information leak and ASLR bypass.
- Product
- ONLYOFFICE DocumentServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.CVE-2026-41030 · Other software · Ascensio · reported by MITREMedium 6.2
In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.
- Product
- ONLYOFFICE DesktopEditors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name.CVE-2025-68936 · Other software · ONLYOFFICE · reported by MITREMedium 6.4
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2025ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window.CVE-2025-68935 · Other software · ONLYOFFICE · reported by MITREMedium 6.4
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form.CVE-2025-68917 · Other software · ONLYOFFICE · reported by MITREMedium 6.4
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2025NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management.CVE-2025-64766 · Other software · NixOS · reported by GitHubMedium 5.3
NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.
- Product
- nixpkgs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0.CVE-2025-10255 · Other software · Ascensio System SIA · reported by VulDBLow 2
A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
- Product
- OnlyOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0.CVE-2025-10254 · Other software · Ascensio System SIA · reported by VulDBLow 2
A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.aspx of the component SVG Image Handler. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
- Product
- OnlyOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025ONLYOFFICE Docs: Privilege EscalationCVE-2025-6380 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment ID maps to an existing attachment post, but does not verify the requester’s identity or capabilities. This makes it possible for unauthenticated attackers to log in as an arbitrary user.
- Product
- ONLYOFFICE Docs
- Affected
- 1.1.0 to 2.2.0
- What to do
- Affects 1.1.0 to 2.2.0. Update ONLYOFFICE Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2025ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI CVE-2025-5301 · Other software · OnlyOffice · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6.1
ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response.
- Product
- Docs (DocumentServer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comr.sec-consult.com
Apr 1, 2025Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter CVE-2023-46988 · Other software · Onlyoffice · reported by MITREMedium 6.7
Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, leading to unauthorized access to sensitive files and potential Denial of Service (DoS).
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024ONLYOFFICE DocSpace: Stored Cross-Site ScriptingCVE-2024-11750 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ONLYOFFICE DocSpace
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update ONLYOFFICE DocSpace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024ONLYOFFICE Docs: Stored Cross-Site ScriptingCVE-2024-11450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ONLYOFFICE Docs
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update ONLYOFFICE Docs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2024ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro.CVE-2024-44085 · Other software · onlyoffice · reported by MITREMedium 6.1
ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883.
- Product
- docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by direCVE-2023-50883 · Other software · onlyoffice · reported by MITREMedium 6.1
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446.
- Product
- docs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript fiCVE-2023-30188 · Other software · Onlyoffice · reported by MITREHigh 7.5
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 14, 2023An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScriCVE-2023-30187 · Other software · Onlyoffice · reported by MITRECritical 9.8
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 14, 2023A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.CVE-2023-30186 · Other software · Onlyoffice · reported by MITRECritical 9.8
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 22, 2023Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.CVE-2023-34939 · Other software · Onlyoffice · reported by MITRECritical 9.8
Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.
- Product
- Onlyoffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2023ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directoCVE-2022-48422 · Other software · Onlyoffice · reported by MITREHigh 7.8
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.onlyoffice.comforum.onlyoffice.com
Feb 7, 2023Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS)CVE-2022-47412 · Other software · ONLYOFFICE · reported by cve@rapid7.comMedium 5.4
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
- Product
- Workspace
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF).CVE-2021-43449 · Other software · Onlyoffice · reported by MITREHigh 8.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation.CVE-2021-43448 · Other software · Onlyoffice · reported by MITREMedium 5.3
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.CVE-2021-43447 · Other software · Onlyoffice · reported by MITREHigh 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS).CVE-2021-43446 · Other software · Onlyoffice · reported by MITREMedium 6.1
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.CVE-2021-43445 · Other software · Onlyoffice · reported by MITRECritical 9.8
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jan 23, 2023ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.CVE-2021-43444 · Other software · Onlyoffice · reported by MITREHigh 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
Jun 2, 2022Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/foCVE-2022-29777 · Other software · Onlyoffice · reported by MITRECritical 9.8
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.CVE-2022-29776 · Other software · Onlyoffice · reported by MITRECritical 9.8
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript throuCVE-2022-24229 · Other software · Onlyoffice · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.CVE-2021-40864 · Other software · Onlyoffice · reported by MITRECritical 9.8
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.
- Product
- Google Translate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2021A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21.CVE-2021-25833 · Other software · Onlyoffice · reported by MITRECritical 9.8
A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability, a remote attacker can obtain remote code execution on DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2021A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0.CVE-2021-25832 · Other software · Onlyoffice · reported by MITRECritical 9.8
A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability, an attacker is able to gain remote code executions on DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2021A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3.CVE-2021-25831 · Other software · Onlyoffice · reported by MITRECritical 9.8
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling, a remote attacker can obtain remote code execution on DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2021A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13.CVE-2021-25830 · Other software · Onlyoffice · reported by MITRECritical 9.8
A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling, an attacker can achieve remote code execution on DocumentServer.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2021An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3.CVE-2021-25829 · Other software · Onlyoffice · reported by MITREHigh 7.5
An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021ONLYOFFICE Docs Server Path Traversal VulnerabilityCVE-2021-3199 · Other software · ONLYOFFICE · reported by MITREExploitedCritical 9.8
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
- Product
- Docs
- On CISA’s list since
- Oct 8, 2026 (federal fix deadline Oct 11, 2026)
- What to do
- Attackers are using this now. Install ONLYOFFICE’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA cataloggithub.comgithub.com
Apr 15, 2020A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0.CVE-2020-11537 · Other software · Onlyoffice · reported by MITRECritical 9.8
A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 15, 2020An issue was discovered in ONLYOFFICE Document Server 5.5.0.CVE-2020-11536 · Other software · Onlyoffice · reported by MITRECritical 9.8
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 15, 2020An issue was discovered in ONLYOFFICE Document Server 5.5.0.CVE-2020-11535 · Other software · Onlyoffice · reported by MITRECritical 9.8
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 15, 2020An issue was discovered in ONLYOFFICE Document Server 5.5.0.CVE-2020-11534 · Other software · Onlyoffice · reported by MITRECritical 9.8
An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary (such as curl or wget) and remotely execute code on a victim's server.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.