CVE-2026-110652
MediumCVSS 4.0Summary
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint. Attackers can bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
Risk Assessment
An unauthenticated remote attacker could access internal network resources and cloud metadata through the ONLYOFFICE DocumentServer. This may lead to disclosure of sensitive information and use of the server as a proxy for attacks on internal infrastructure.
Recommendation
Update ONLYOFFICE DocumentServer to version 10.0.0 or later. Ensure JWT verification is enabled and configure appropriate outbound network request filtering.
Other vulnerabilities in ONLYOFFICE DocumentServer
See all- CVE-2023-30187Critical
An out-of-bounds memory access vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2. A remote attacker can execute arbitrary code using a crafted JavaScript file.
- CVE-2023-30186Critical
A use-after-free vulnerability in ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2 allows remote attackers to execute arbitrary code via a crafted JavaScript file.
Original NVD description (English source)
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS