CVE-2025-68917
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
Risk Assessment
An attacker can inject malicious script executed in the user's browser, potentially leading to session or data theft.
Recommendation
Update ONLYOFFICE Docs to version 9.2.1 or later.
Other vulnerabilities in ONLYOFFICE Docs
See all- CVE-2025-68936Medium
ONLYOFFICE Docs before version 9.2.1 contains an XSS vulnerability related to the Color theme name, which may allow injection of malicious script.
- CVE-2025-68935Medium
XSS vulnerability in ONLYOFFICE Docs before 9.2.1, present in the Font field of the Multilevel list settings window. This is related to DocumentServer.
Original NVD description (English source)
ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS