WATCHExploited vulnerability
ONLYOFFICE Docs
ONLYOFFICE Docs Server Path Traversal Vulnerability
What's happening and what to do
Attackers are actively exploiting a path traversal flaw, using a /.. sequence in an image upload parameter when JWT is enabled, which can lead to remote code execution on the server. ONLYOFFICE Docs Server, installations that use JWT. Apply the vendor's update now and check for signs of compromise.
AI summary of the sources on this page. Regenerated when a source changes.
Signals over time
- 2026-10-08Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-10-11Federal patch deadline for US agencies.
- 2026-11-03 21:55First seen here.
Source text
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.