[ Vendor · 4 CVEs ]
ONLYOFFICE
CVEs affecting ONLYOFFICE published in the last 30 days, plus any ONLYOFFICE CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110652 | 14 Oct 2026 | CVSS 4.0 | ONLYOFFICE DocumentServerONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint… | |
| CVE-2026-110385 | 14 Oct 2026 | CVSS 8.7 | ONLYOFFICE Document ServerA remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid… | |
| CVE-2021-3199 | 26 Jan 2021 | CVSS 9.8 | Path traversal in ONLYOFFICE Document Server leads to code executionDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence… | Exploited |
| CVE-2021-3199 | 26 Jan 2021 | CVSS 9.8 | Path traversal in ONLYOFFICE Document Server leads to code executionDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence… | Exploited |