CVE-2023-25266

Docmosis Tornado prior to 2.9.5 is affected. An authenticated attacker can modify the Office directory setting to point to an arbitrary remote network path, causing the soffice binary to execute under the attacker’s control and enabling arbitrary remote code execution (RCE). Impact is high (CVE-2...

CVE-2023-25264

CVE-2023-25264 affects Docmosis Tornado prior to 2.9.5. An unauthenticated attacker can bypass the authentication check by sending a crafted request with relative path segments, effectively defeating access controls. Severity is high (CVSS 7.5). If you are using Tornado versions before 2.9.5, upg...

CVE-2023-25265

Docmosis Tornado

CVE-2024-42733

CVE-2024-42733 affects Docmosis Tornado