CVE-2023-30186

CriticalCVSS 9.8

Published: 14/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.68%

74th percentile - higher than 74% of all known CVEs

Summary

A use-after-free vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 allows remote attackers to execute arbitrary code via a crafted JavaScript file.

Risk Assessment

An attacker can remotely take control of the document server, compromising the confidentiality, integrity, and availability of organizational data.

Recommendation

Immediately update ONLYOFFICE DocumentServer to version 7.3.3 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.