cyfenced.com →

[ CVE-2021-3199 · Published 26 Jan 2021 ]

Path traversal in ONLYOFFICE Document Server leads to code execution

Exploited · CISA KEV CVSS 9.8 EPSS 20%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-08
  • EPSS: 20% chance of exploitation in the next 30 days (higher than 97% of CVEs)
  • Critical severity: CVSS 9.8

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited and the attack needs no credentials.

Red alert if
You run ONLYOFFICE Document Server older than 5.6.3, with JWT enabled, reachable from the internet.
Can wait if
You run a current Document Server release, or do not use ONLYOFFICE.
What it is
A directory traversal flaw in the /upload endpoint of ONLYOFFICE Document Server before 5.6.3 allows remote code execution when JWT is in use. The flaw dates from 2021 but CISA added it to its exploited list in October 2026.
Impact
An attacker without credentials can write files outside the intended directory and run code on the document server. Document servers handle the files your staff edit, so a compromise can expose company documents and provide a foothold next to the file-sharing platform it is connected to.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker sends a crafted image upload to the internet-facing document server.
  2. T1505.003 Server Software Component: Web ShellThe traversal places a file the server will execute.
  3. T1059 Command and Scripting InterpreterCommands run on the document server.
  4. T1213 Data from Information RepositoriesDocuments processed by the server are read.

What to do

  1. Upgrade ONLYOFFICE Document Server to 5.6.3 or later; a current release is strongly recommended.
  2. Check integrations, such as Nextcloud or other file-sharing platforms, that bundle their own Document Server copy.
  3. Review the server for unknown files in its web and upload directories.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

CISA: ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 11 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References