CVE-2021-3199 ONLYOFFICE Docs
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
- CVSS
- 9.8 Critical
- EPSS
- 30%
- Percentile
- 98
- Published
- 2021-01-22
- Force
- 10 of 12
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
ONLYOFFICE Docs Server Path Traversal Vulnerability
- Added
- 2026-10-08
- Federal patch deadline
- 2026-10-11
- Ransomware use
- not known