ONLYOFFICE Docs Remote Code Execution Vulnerability

Back Hkcert

ONLYOFFICE Docs Remote Code Execution Vulnerability

Hkcert • October 9, 2026

Share: View original

A vulnerability was identified in ONLYOFFICE Docs. A remote attacker could exploit this vulnerability to trigger remote code execution and security restriction bypass on the targeted system.

CVE-2021-3199 is being exploited in the wild. ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Hence, the risk level is rated as High Risk.

Security Restriction Bypass

Remote Code Execution

System / Technologies affected

ONLYOFFICE Document Server versions earlier than 5.6.3

ONLYOFFICE Document Server to version 5.6.3 or later

Vulnerability Identifier

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Urgent CVE-2021-3199 Vulnerability in ONLYOFFICE Exploited in the Wild A vulnerability, CVE-2021-3199, has been identified in ONLYOFFICE Document Server versions prior to 5.6.3, allowing remote code execution through a path traversal flaw when using JWT. Exploitation is confirmed in the wild, with attackers able to manipulate image upload parameters to gain unauthorized control over the document-processing service. This vulnerability poses a high risk as it can lead to complete system compromise, affecting organizations with internet-accessible collaborative document services. The issue was added to the CISA KEV catalog on 2026-10-08, indicating active exploitation. Users are advised to upgrade to version 5.6.3 or later immediately. Until then, restricting access to upload endpoints and validating upload paths is recommended. 2 sources 73

Extracted Entities

Attack Types (1)

Remote Code Execution

CVEs (1)

CWE Weaknesses (1)

CWE-22 - Path Traversal

MITRE ATT&CK (1)

T1203 - Exploitation for Client Execution

Platforms (1)

Onlyoffice Document Server