The vulnerability of the UPDATE service for the ONLYOFFICE Desktop Editors allows a hacker to execute arbitrary code.

The vulnerability of the ONLYOFFICE Desktop Editors office package lies in the lack of validation during the processing of incoming requests. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2026-41030

In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges...

CVE-2026-41030

CVE-2026-41030 affects ONLYOFFICE DesktopEditors prior to 9.3.0. The update service can be abused to perform actions on files with SYSTEM privileges, indicating a local privilege escalation. CVSS 3.1: AV=L/AC=L/PR=N/UI=N/S=U, Impact: Confidentiality=NONE, Integrity=NONE, Availability=HIGH. Exploi...