onlyoffice has 5 CVEs on record between 2021 and 2026. 2 were published in the last 90 days. The median CVSS is 6.4 (medium), with 1 rated critical. 20% have been exploited in the wild — well above the 1% corpus average, so onlyoffice flaws are worth patching on sight. Most affected products: document_server (3), Document Server (1), DocumentServer (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 20% vs 1% corpus
- Median CVSS
- 6.4
- Publish → KEV
- —(1)
- Last 90 days
- 2 prev 0
Products
- document_server 3
- Document Server 1
- DocumentServer 1
Worst active — by depth score
CVE-2021-3199Critical· 9.8Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.85CVE-2026-110385High· 8.7A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account48CVE-2025-68936Medium· 6.4ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name35CVE-2025-68935Medium· 6.4ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window35CVE-2026-110652Medium· 4.0ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploitin…22
onlyoffice vulnerabilities
CVEs affecting onlyoffice, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-110652Medium· 4.0ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploitin…
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploitin…
CVE-2026-110385High· 8.7A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Do…
CVE-2025-68936Medium· 6.4ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
CVE-2025-68935Medium· 6.4ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
CVE-2021-3199Critical· 9.8CISA KEVPoCDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.