214 matches found
OnlyOffice-path-traversal
ONLYOFFICE Path Traversal Exploit CVE-2023-46988 📌 Overview This script exploits a path traversal vulnerability in ONLYOFFICE Document Server CVE-2023-46988 that allows unauthorized users to copy arbitrary files from the server. The vulnerability exists in the /example/editor endpoint, where the...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
EUVD-2026-100761
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-110385
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-110385
The ONLYOFFICE Document Server (versions before 10.0.0 ) is vulnerable to remote code execution via a flaw in the Document Builder API . An authenticated attacker possessing a valid Inbox-compatible JWT can provide user-controlled converter XML through the optional third argument of builder.SaveF...
CVE-2026-110385: External Control of File Name or Path
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...
CVE-2026-84282
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
CVE-2026-84282
A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12) developed by Ascensio System SIA . The /apps/onlyoffice/ajax/settings/address endpoint fails to sufficiently validate user-supplied Document Server URLs before initiating outboun...
CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
EUVD-2026-72807
A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...
ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability
Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...
CVE-2026-41034
ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion via pictFmla.cbBufInCtlStm and other vectors, leading to an information leak and ASLR bypass...
CVE-2026-7314
A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function getdocpath of the file src/spiredocmcp/api/base.py. Performing a manipulation of the argument documentname results in path traversal. The attack can be initiated remotely. The exploit is now public and...
ONLYOFFICE Docs Filesystem Code Execution
The vulnerability of the office online package ONLYOFFICE Docs is related to the incorrect definition of symbolic links before accessing a file. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
EUVD-2025-205393
ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer...
EUVD-2025-205392
ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer...