ONLYOFFICE Document Server: Remote code execution via Document Builder
Summary
ONLYOFFICE Document Server versions before 10.0.0 contain a flaw in how the Document Builder API processes user-supplied converter XML. An attacker with a valid Inbox-compatible JWT can inject a duplicate m_sFileTo element, overwrite the output path, and modify the runtime.json configuration file. Arbitrary operating system commands can then run as the ds service account when a later Document Builder job is processed. The CNA rates this as CVSS 4.0 8.7 (High), and NVD analysis was still pending at the time of writing.
Affected
- ONLYOFFICE Document Server versions before 10.0 (CNA: 0 to below 10.0)
- The Document Builder and FileConverter modules are named by the CNA
- Windows exposure: Unknown.
Fixed in
- Update to ONLYOFFICE Document Server 10.0.0 or later. The exact build number is not confirmed in the sources.
Workaround
- No vendor workaround for versions before 10.0 is published in the sources.
- Version 10.0 changes the token model: the /converter, /docbuilder and /command endpoints no longer accept a token from the editor configuration, and empty or unset secrets are rejected.
Exploitation
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No known exploitation in the wild found in the sources. The CISA Known Exploited Vulnerabilities catalogue was not checked.
- No public proof of concept found.
Our recommendation
- Upgrade all Document Server instances to 10.0.0 or later as a priority.
- Restrict network access so that only integration servers can reach Document Server, and keep it off the public internet where possible.
- Use strong, non-empty JWT secrets and rotate them, because the attack requires a valid token.
- Monitor runtime.json and Document Builder settings for unexpected changes until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record on Strix www.strix.ai
- CVE record on Vulners vulners.com
- CVE details on ThreatInt cve.threatint.com
- ONLYOFFICE 10.0 security fixes blog www.onlyoffice.com
- ONLYOFFICE 10.0.0 changelog api.onlyoffice.com
- ONLYOFFICE 10.0 for developers: what's new community.onlyoffice.com
- Document Server CHANGELOG (GitHub) github.com
- Document Builder API documentation api.onlyoffice.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:13.
Original description (NVD)
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled converter XML supplied through the optional third argument of builder.SaveFile(). By injecting a duplicate m_sFileTo element, an attacker can override the server-generated output path and write arbitrary content outside the designated job directory. This allows the attacker to overwrite the runtime.json configuration file, modify the Document Builder executable path and arguments, and execute arbitrary commands when a subsequent Document Builder job is processed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.