Onlyoffice Server vulnerabilities

• onlyoffice documentserver ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass CVE-2026-110652 6.3 MediumOctober 14, 2026
• onlyoffice document server A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows... CVE-2026-110385 8.7 HighOctober 14, 2026
• onlyoffice document server ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. CVE-2025-68936 6.4 MediumDecember 25, 2025
• onlyoffice document server ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings... CVE-2025-68935 6.4 MediumDecember 25, 2025
• onlyoffice document server ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is... CVE-2025-68917 6.4 MediumDecember 24, 2025
• onlyoffice docs (documentserver) Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer) CVE-2025-5301 EPSS 62.4% 6.1 MediumJune 12, 2025
• onlyoffice document server Directory Traversal vulnerability in ONLYOFFICE Document Server v.7.5.0 and before allows a... CVE-2023-46988 Public exploit 6.7 MediumApril 1, 2025
• onlyoffice docs, document server +1 more ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function... CVE-2023-50883 6.1 MediumSeptember 9, 2024
• onlyoffice document server Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote... CVE-2023-30188 7.5 HighAugust 14, 2023
• onlyoffice document server An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2... CVE-2023-30187 9.8 CriticalAugust 14, 2023
• onlyoffice document server A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote... CVE-2023-30186 9.8 CriticalAugust 14, 2023
• onlyoffice document server ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges... CVE-2022-48422 7.8 HighMarch 19, 2023
• onlyoffice server ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The... CVE-2021-43449 8.1 HighJanuary 23, 2023
• onlyoffice server ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of... CVE-2021-43448 5.3 MediumJanuary 23, 2023
• onlyoffice server ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An... CVE-2021-43447 7.5 HighJanuary 23, 2023
• onlyoffice server ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros... CVE-2021-43446 6.1 MediumJanuary 23, 2023
• onlyoffice server ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can... CVE-2021-43445 9.8 CriticalJanuary 23, 2023
• onlyoffice server ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document... CVE-2021-43444 7.5 HighJanuary 23, 2023
• onlyoffice core, document server +1 more Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to... CVE-2022-29777 9.8 CriticalJune 1, 2022
• onlyoffice core, document server +1 more Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to... CVE-2022-29776 9.8 CriticalJune 1, 2022
• onlyoffice document server A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0... CVE-2022-24229 6.1 MediumApril 8, 2022
• onlyoffice document server 12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 CVE-2021-25833 EPSS 43.5% 9.8 CriticalMarch 1, 2021
• onlyoffice document server A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of... CVE-2021-25832 EPSS 12.6% 9.8 CriticalMarch 1, 2021
• onlyoffice document server A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9... CVE-2021-25831 EPSS 11.5% 9.8 CriticalMarch 1, 2021
• onlyoffice document server A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0... CVE-2021-25830 EPSS 11.8% 9.8 CriticalMarch 1, 2021
• onlyoffice document server An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE... CVE-2021-25829 7.5 HighMarch 1, 2021
• onlyoffice document server, docs +1 more Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server... CVE-2021-3199 In KEV EPSS 30.2% 9.8 CriticalJanuary 22, 2021
• onlyoffice document server An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious ... CVE-2020-11534 9.8 CriticalApril 15, 2020
• onlyoffice document server An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious ... CVE-2020-11535 9.8 CriticalApril 15, 2020
• onlyoffice document server An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious ... CVE-2020-11536 9.8 CriticalApril 15, 2020
• onlyoffice document server A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute... CVE-2020-11537 9.8 CriticalApril 15, 2020