ONLYOFFICE Document Server: Directory traversal with remote code execution
Deadline for US federal agencies: 11 Oct 2026
Summary
ONLYOFFICE Document Server before 5.6.3 contains a directory traversal flaw in the /upload endpoint when JWT is used. An attacker can supply a /.. sequence in an image upload parameter to reach paths outside the intended directory, which can lead to remote code execution. CISA lists the flaw as known exploited, and HKCERT states it is being exploited in the wild. Whether a valid token is needed is disputed, so JWT should not be relied on as a barrier.
Affected
- ONLYOFFICE Document Server versions before 5.6.3
- Configurations where JWT is used (per the CVE description)
Fixed in
- Upgrade to ONLYOFFICE Document Server 5.6.3 or later
- Backported patches for older branches: Unknown.
Workaround
- No vendor workaround found. The fix is the upgrade.
- Interim measures (research recommendation, not from a vendor source): restrict access to Document Server to the integrating application only, and block direct internet access to /upload. Verify the integration still works first.
- Disabling JWT is not a mitigation for this CVE.
Exploitation
- CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-08.
- HKCERT states the CVE is being exploited in the wild.
- A China-linked threat actor (Flax Typhoon) is reported as involved; this attribution is unconfirmed.
- Public proof-of-concept exploit code is referenced; it has not been reviewed.
Our recommendation
- Inventory all Document Server instances, including Docker images and appliances.
- Upgrade every instance to 5.6.3 or later as a priority.
- Check whether any instance is reachable from the internet, and restrict access to the integrating application only.
- For instances exposed before patching, check for signs of compromise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- HKCERT Security Bulletin www.hkcert.org
- ONLYOFFICE DocumentServer CHANGELOG (5.6.3) github.com
- VulDB entry 168767 vuldb.com
- The Hacker News: Flax Typhoon exploits five flaws thehackernews.com
- ONLYOFFICE Docs changelog (helpcenter) helpcenter.onlyoffice.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:25.
Original description (NVD)
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (7)
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.