CVE-2023-34939

CriticalCVSS 9.8

Published: 22/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.89%

89th percentile - higher than 89% of all known CVEs

Summary

A remote code execution (RCE) vulnerability was discovered in Onlyoffice Community Server before version 12.5.2 via the UploadProgress.ashx component.

Risk Assessment

Exploitation of this vulnerability could allow an attacker to remotely execute code on the server, posing a serious security risk to the organization.

Recommendation

It is recommended to upgrade to version 12.5.2 or later to mitigate this vulnerability.

Original NVD description (English source)

Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.