Zero Radar
← feed
CriticalVulnerabilityCVE-2021-3199updated 25 Oct 2026, 17:35 UTC

ONLYOFFICE Docs: file upload flaw lets attackers run code on the server

Attackers can trick the document server into saving files outside the folder it should use, which can let them run their own code on the machine. Attackers are actively exploiting this.

Exploited (CISA KEV)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?YesConfirmed by CISA KEV · 8 Oct 2026,
Fix available?YesUpgrade to ONLYOFFICE Document Server 5.6.3 or later. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted upload with /.. sequence
  2. 2Request reaches serverDocument Server exposed to network
  3. 3Path traversal occursUpload escapes intended directory with JWT enabled
  4. 4Code executedRemote code runs on the server
  5. ResultAttacker controls the server

What happened

A directory traversal flaw in the /upload endpoint of ONLYOFFICE Document Server, when JWT is enabled, lets a crafted /.. sequence in an image upload parameter escape the intended directory and can lead to remote code execution.

Why it is dangerous: An attacker who can reach the server can potentially take full control of it, reading or changing documents and other data. Organizations that run ONLYOFFICE Document Server with internet exposure are at highest risk.

Are you affected?

You are affected if you run ONLYOFFICE Document Server before 5.6.3 with JWT enabled and the /upload endpoint reachable.

ONLYOFFICE Document Server versions before 5.6.3 (with JWT used).

What to do

  1. Upgrade ONLYOFFICE Document Server to version 5.6.3 or later
  2. If you cannot upgrade immediately, restrict access to the /upload endpoint and limit internet exposure of the server
  3. Follow CISA BOD 26-04 guidance and CISA forensics triage requirements, and check the server for signs of compromise
  4. If mitigations are unavailable, discontinue use of the product

Timeline

  1. 24 May 2022, 17:40 UTC
    Publicly disclosed
  2. 8 Oct 2026, 00:00 UTC
    Reported by CISA KEV · CISA KEV
  3. 25 Oct 2026, 17:35 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 25 Oct 2026, 17:35 UTC
    Fix: Upgrade to ONLYOFFICE Document Server 5.6.3 or later.

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2021-3199 · GHSA-vm8r-r39c-96c6
CVSS
9.8 / 10
EPSS
30% chance of exploitation within 30 days
Disclosed
24 May 2022, 17:40 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ONLYOFFICE Docs: file upload flaw lets attackers run code on the server · Zero Radar