ONLYOFFICE Document Server Path Traversal Vulnerability

Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets and presentations, among others. A path traversal vulnerability exists in ONLYOFFICE Document Server, which stems from th...

OnlyOffice Document Server path traversal vulnerability

Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets and presentations, among others. A path traversal vulnerability exists in ONLYOFFICE Document Server, which stems from th...

PT-2021-19619

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Document Server versions prior to 5.6.3 Description: The issue allows directory traversal with remote code execution in the /upload endpoint of ONLYOFFICE Document Server when JWT is used. This can be achieved by including a /...