CVE-2023-30187

CriticalCVSS 9.8

Published: 14/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.73%

75th percentile - higher than 75% of all known CVEs

Summary

An out-of-bounds memory access vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2. A remote attacker can execute arbitrary code using a crafted JavaScript file.

Risk Assessment

Risk of full server compromise and potential exposure of sensitive documents processed by the ONLYOFFICE platform.

Recommendation

Immediately update ONLYOFFICE DocumentServer to version 7.3.3 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.