onlyoffice

Top products

The 15 most recently published vulnerabilities affecting onlyoffice.

• CVE-2025-68936ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.6.4Dec 25, 2025
• CVE-2025-68935ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.6.4Dec 25, 2025
• CVE-2025-68917ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.6.4Dec 24, 2025
• CVE-2025-6380ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function9.8Jul 24, 2025
• CVE-2025-5301Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)6.1Jun 12, 2025
• CVE-2023-46988Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, lead...6.7Apr 1, 2025
• CVE-2024-11750ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4Dec 12, 2024
• CVE-2024-11450ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4Dec 6, 2024
• CVE-2024-44085ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this is...6.1Sep 9, 2024
• CVE-2023-50883ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the F...6.1Sep 9, 2024
• CVE-2023-30187An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.9.8Aug 14, 2023
• CVE-2023-30186A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.9.8Aug 14, 2023
• CVE-2023-30188Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.7.5Aug 14, 2023
• CVE-2023-34939Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.9.8Jun 22, 2023
• CVE-2022-48422ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in whi...7.8Mar 19, 2023