ONLYOFFICE Docs Remote Code Execution Vulnerability
Release Date: 9 Oct 2026
A vulnerability was identified in ONLYOFFICE Docs. A
remote attacker could exploit this vulnerability to trigger remote code
execution and security restriction bypass on the targeted system.
Note:
CVE-2021-3199 is being exploited in the
wild. ONLYOFFICE Docs contains a path traversal vulnerability that can
occur when JWT is used, via a /.. sequence in an image upload parameter and
could allow for remote code execution. Hence, the risk level is rated as
High Risk.
Impact
- Security
Restriction Bypass
- Remote
Code Execution
System / Technologies affected
- ONLYOFFICE
Document Server versions earlier than 5.6.3
Solutions
- ONLYOFFICE
Document Server to version 5.6.3 or later
Vulnerability Identifier
Source
Related Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
沒有留言:
發佈留言