Onlyoffice - vulnerabilities (CVEs)

38 CVEs in 11 products, 2 in the last 30 days, newest from 2026-10-14.

Products

Document Server - 23 CVEs
Server - 6 CVEs
Core - 2 CVEs
Docs - 2 CVEs
Onlyoffice - 2 CVEs
Onlyoffice Docs - 2 CVEs
Docs Documentserver - 1 CVEs
Documentserver - 1 CVEs
Google Translate - 1 CVEs
Onlyoffice Docspace - 1 CVEs
Workspace - 1 CVEs

Newest CVEs of Onlyoffice

CVE-2026-110652 - CVSS 6.3 (medium), 2026-10-14: ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows…
CVE-2026-110385 - CVSS 8.7 (high), 2026-10-14: A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT…
CVE-2025-68936 - CVSS 6.4 (medium), 2025-12-25: ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
CVE-2025-68935 - CVSS 6.4 (medium), 2025-12-25: ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
CVE-2025-68917 - CVSS 6.4 (medium), 2025-12-24: ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.
CVE-2025-6380 - CVSS 9.8 (critical), 2025-07-24: The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions…
CVE-2025-5301 - CVSS 6.1 (medium), 2025-06-12: ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the…
CVE-2023-46988 - CVSS 6.7 (medium), 2025-04-01: Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt…
CVE-2024-11750 - CVSS 6.4 (medium), 2024-12-12: The ONLYOFFICE DocSpace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice-docspace' shortcode in all versions up…
CVE-2024-11450 - CVSS 6.4 (medium), 2024-12-06: The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and…
CVE-2024-44085 - CVSS 6.1 (medium), 2024-09-09: ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function…
CVE-2023-50883 - CVSS 6.1 (medium), 2024-09-09: ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by…
CVE-2023-30187 - CVSS 9.8 (critical), 2023-08-14: An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted…
CVE-2023-30186 - CVSS 9.8 (critical), 2023-08-14: A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
CVE-2023-30188 - CVSS 7.5 (high), 2023-08-14: Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript…
CVE-2023-34939 - CVSS 9.8 (critical), 2023-06-22: Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.
CVE-2022-48422 - CVSS 7.8 (high), 2023-03-19: ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working…
CVE-2022-47412 - CVSS 5.4 (medium), 2023-02-07: Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting…
CVE-2021-43444 - CVSS 7.5 (high), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL…
CVE-2021-43447 - CVSS 7.5 (high), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit…
CVE-2021-43446 - CVSS 6.1 (medium), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site…
CVE-2021-43449 - CVSS 8.1 (high), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve…
CVE-2021-43445 - CVSS 9.8 (critical), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE…
CVE-2021-43448 - CVSS 5.3 (medium), 2023-01-23: ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of…
CVE-2022-29777 - CVSS 9.8 (critical), 2022-06-02: Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component…
CVE-2022-29776 - CVSS 9.8 (critical), 2022-06-02: Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component…
CVE-2022-24229 - CVSS 6.1 (medium), 2022-04-08: A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript…
CVE-2021-40864 - CVSS 9.8 (critical), 2021-09-10: The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.
CVE-2021-25831 - CVSS 9.8 (critical), 2021-03-01: A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the…
CVE-2021-25830 - CVSS 9.8 (critical), 2021-03-01: A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the…