All packages
ONLYOFFICE Document Server vulnerabilities
3 known CVE vulnerabilities in ONLYOFFICE Document Server, translated and rated.
- CVE-2026-110385High
A remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0 allows an authenticated attacker with a valid JWT to execute arbitrary operating system commands as the ds service account.
- CVE-2021-3199CriticalActively exploited
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
- CVE-2023-30188High
A memory exhaustion vulnerability in ONLYOFFICE Document Server versions 4.0.3 through 7.3.2 allows a remote attacker to cause a denial of service via a crafted JavaScript file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS