CVE-2021-3199

ONLYOFFICE Document Server is software businesses use to create and edit documents online, similar to how Google Docs works behind the scenes. This flaw is like a hidden back door in the file-upload feature — attackers can sneak outside the intended storage folder and plant their own instructions, effectively seizing control of the whole server, not just the documents on it.

This matters to you if you run ONLYOFFICE Document Server, whether self-hosted or embedded in another platform you use for collaborative document editing. The flaw works even when the extra JWT security setting is turned on, and it does not require any login — if the server is reachable from the internet, it is exposed.

Attackers are already exploiting this vulnerability in the wild, and it is listed on CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of October 11, 2026. Public proof-of-concept exploit code is also available, making attacks easy to replicate. This requires immediate action — do not wait.

Confirm exposure by checking the ONLYOFFICE Document Server version in use; any version prior to 5.6.3 is vulnerable, including deployments where JWT authentication is enabled. Upgrade to version 5.6.3 or later as the definitive fix — there is no safe configuration workaround that fully closes the traversal path short of patching. If immediate patching is not possible, remove internet exposure of the /upload endpoint (e.g., via firewall rules or reverse-proxy restrictions) and restrict access to trusted internal networks only, per CISA's BOD 26-04 guidance for internet-exposed assets; if mitigations cannot be applied, consider discontinuing use of the exposed instance until patched. CISA's remediation due date is 2026-10-11 — treat this as a hard deadline for any internet-facing instance. Monitor for exploit indicators referencing '/..' sequences in upload requests to the /upload endpoint, unexpected file writes outside the designated upload directory, and unusual process execution originating from the Document Server process. Given two known public PoCs on GitHub, assume automated scanning for this flaw is occurring broadly.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — unauthenticated, network-exploitable, no user interaction, full compromise of confidentiality, integrity, and availability. Weakness: CWE-22 (Path Traversal) in the /upload image upload handler, bypassing JWT-based request authentication to reach the vulnerable code path, enabling arbitrary file write leading to remote code execution. Confirmed in CISA KEV (added 2026-10-08, due 2026-10-11), indicating active exploitation in the wild — this supersedes any EPSS-based likelihood estimate. Exploit maturity is high: two public PoCs exist on GitHub, and press attention is rising, increasing the likelihood of opportunistic mass exploitation.