Dromara Skyeye: SSRF and missing authorization in OnlyOffice callback
Summary
Dromara Skyeye, an open-source Java platform with file storage, contains a server-side request forgery and missing authorization flaw in its OnlyOffice save callback (editUploadOfficeFileById), up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321. An unauthenticated attacker can make the server fetch internal URLs and overwrite any user's stored file, then read the result. Exposure matters only if a Skyeye instance is deployed and reachable from untrusted networks.
Affected
- Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 (all earlier commits)
- No release version numbers identified
Fixed in
Unknown. No vendor fix or patch commit has been published.
Workaround
- No vendor workaround known
- Do not expose the instance to the internet; use a VPN or an authenticated proxy
- Block the OnlyOffice callback path from untrusted networks at the reverse proxy
- Restrict outbound connections from the application server
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact
- Not listed as known exploited (KEV); no confirmed in-the-wild use found
- Technical details are public in the reporter's issue
Our recommendation
- Check the asset inventory for Skyeye, including git-based deployments
- If found and internet-facing, take it offline or restrict access immediately
- Review file integrity, logs and backups; keep offline or immutable backups
- Also assess sibling CVE-2026-107780 (OS command injection) and CVE-2026-107779 (missing authentication in xxl-job endpoint)
- Monitor the GitHub issue for a fix; treat the product as unpatched until then
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dromara Skyeye GitHub repository github.com
- Vulnerable code at commit 003549ae github.com
- GitHub issue #29 (reporter's report) github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-107781 osv.dev
- VulDB entry vuldb.com
- Strix CVE overview www.strix.ai
- CVE record (CVEProject cvelistV5) raw.githubusercontent.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:12.
Original description (NVD)
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.