ONLYOFFICE
Vulnerability activity for ONLYOFFICE: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 0
Last 365 days
- CVEs
- 5
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 4.0MediumOct 14, 2026ONLYOFFICE DocumentServer SSRFCVE-2026-110652ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server
- 8.7HighOct 14, 2026ONLYOFFICE Document Server Path traversal / file handlingCVE-2026-110385A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary con1% likely
- 9.8CriticalOct 8, 2026ONLYOFFICE Docs Path traversal / file handlingCVE-2021-3199ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.Exploited20% likely
- 6.4MediumDec 25, 2025Onlyoffice document server XSSCVE-2025-68936ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
- 6.4MediumDec 25, 2025Onlyoffice document server XSSCVE-2025-68935ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
Top products
- Document Server3 CVEs in the last year
- DocumentServer1 CVE in the last year
- Docs1 CVE in the last year, 1 critical, 1 exploited
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.