Onlyoffice
Onlyoffice Document Server: vulnerabilidades y CVE
Onlyoffice Document Server tiene 22 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 13 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE22
Últimos 12 meses3
Críticas13
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-68936 | Media (6.1) | 0.20% | — | 25 dic 2025 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. |
| CVE-2025-68935 | Media (6.1) | 0.20% | — | 25 dic 2025 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer. |
| CVE-2025-64766 | Media (5.3) | 0.27% | — | 17 nov 2025 | NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded… |
| CVE-2023-46988 | Media (6.7) | 0.52% | — | 1 abr 2025 | Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, leading to unauthorized… |
| CVE-2023-50883 | Media (6.1) | 0.61% | — | 9 sept 2024 | ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE:… |
| CVE-2023-30188 | Alta (7.5) | 2.2% | — | 14 ago 2023 | Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file. |
| CVE-2023-30187 | Crítica (9.8) | 2.4% | — | 14 ago 2023 | An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. |
| CVE-2023-30186 | Crítica (9.8) | 2.3% | — | 14 ago 2023 | A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. |
| CVE-2022-48422 | Alta (7.8) | 0.30% | — | 19 mar 2023 | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE… |
| CVE-2022-29777 | Crítica (9.8) | 6.9% | — | 2 jun 2022 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h. |
| CVE-2022-29776 | Crítica (9.8) | 6.9% | — | 2 jun 2022 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp. |
| CVE-2022-24229 | Media (6.1) | 1.9% | — | 8 abr 2022 | A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor. |
| CVE-2021-25833 | Crítica (9.8) | 44% | — | 1 mar 2021 | A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file… |
| CVE-2021-25832 | Crítica (9.8) | 13% | — | 1 mar 2021 | A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability, an attacker is able to gain remote code executions… |
| CVE-2021-25831 | Crítica (9.8) | 12% | — | 1 mar 2021 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two… |
| CVE-2021-25830 | Crítica (9.8) | 12% | — | 1 mar 2021 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of… |
| CVE-2021-25829 | Alta (7.5) | 7.4% | — | 1 mar 2021 | An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually… |
| CVE-2021-3199 | Crítica (9.8) | 8.2% | — | 26 ene 2021 | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter. |
| CVE-2020-11537 | Crítica (9.8) | 1.5% | — | 15 abr 2020 | A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API. |
| CVE-2020-11536 | Crítica (9.8) | 2.6% | — | 15 abr 2020 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server. |
| CVE-2020-11535 | Crítica (9.8) | 2.3% | — | 15 abr 2020 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary… |
| CVE-2020-11534 | Crítica (9.8) | 2.2% | — | 15 abr 2020 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary (such as curl or wget) and remotely… |