OnlyOffice vulnerabilities
We track 10 vulnerabilities in OnlyOffice products across 4 products. 10 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on October 14, 2026.
Latest OnlyOffice vulnerabilities
- 8.7 High severity
Document Server: External Control of File Name or Path
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API impr
- 9.8 Critical severity
ONLYOFFICE Docs: Missing Authorization
The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1.1.0 to 2.2.0. The plugin’s permission callback only verifies that the supplied, encrypted attachment
- 7.5 High severity
Document Server: Loop with Unreachable Exit Condition
Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.
- 9.8 Critical severity
Document Server: Out-of-bounds Write
An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
- 9.8 Critical severity
Document Server: Use After Free
A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file.
- 9.8 Critical severity
Onlyoffice: Improper Limitation of a Pathname to a Restricted Directory
Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx.
- 7.8 High severity
Document Server: Uncontrolled Search Path Element
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located.
- 9.8 Critical severity
Core: Out-of-bounds Write
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h.
- 9.8 Critical severity
Core: Out-of-bounds Write
Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp.
- 9.8 Critical severity
ONLYOFFICE Docs Server Path Traversal Exploited
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.