skyeye vulnerabilities

3 known vulnerabilities in skyeye from Dromara. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  skyeye: Server-Side Request Forgery

  CVE-2026-107781Oct 8, 2026Dromara

  Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url a

• 9.8 Critical severity

  skyeye: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-107780Oct 8, 2026DromaraEPSS 2.06%

  Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to

• 9.8 Critical severity

  skyeye: Missing Authentication for Critical Functionality

  CVE-2026-107779Oct 8, 2026Dromara

  Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_