CVE-2025-68935

ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.

Score

CVSS 3.1 6.4 Medium

Status

Analyzed - cve@mitre.org

Published

2025-12-25

Last modified

2026-10-07

Weaknesses

CWE-79

Affected products

• Document Server (Onlyoffice)

References

• https://github.com/ONLYOFFICE/DocumentServer/blob/master/CHANGELOG.md#921