Onlyoffice
Onlyoffice Document Server: vulnerabilities and CVEs
Onlyoffice Document Server has 22 published vulnerabilities, 3 of them in the last 12 months. 13 are rated critical and 0 are listed by CISA as actively exploited.
CVEs22
Last 12 months3
Critical13
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-68936 | Medium (6.1) | 0.20% | — | Dec 25, 2025 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. |
| CVE-2025-68935 | Medium (6.1) | 0.20% | — | Dec 25, 2025 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer. |
| CVE-2025-64766 | Medium (5.3) | 0.27% | — | Nov 17, 2025 | NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded… |
| CVE-2023-46988 | Medium (6.7) | 0.52% | — | Apr 1, 2025 | Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, leading to unauthorized… |
| CVE-2023-50883 | Medium (6.1) | 0.61% | — | Sep 9, 2024 | ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE:… |
| CVE-2023-30188 | High (7.5) | 2.2% | — | Aug 14, 2023 | Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file. |
| CVE-2023-30187 | Critical (9.8) | 2.4% | — | Aug 14, 2023 | An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. |
| CVE-2023-30186 | Critical (9.8) | 2.3% | — | Aug 14, 2023 | A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. |
| CVE-2022-48422 | High (7.8) | 0.30% | — | Mar 19, 2023 | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE… |
| CVE-2022-29777 | Critical (9.8) | 6.9% | — | Jun 2, 2022 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h. |
| CVE-2022-29776 | Critical (9.8) | 6.9% | — | Jun 2, 2022 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp. |
| CVE-2022-24229 | Medium (6.1) | 1.9% | — | Apr 8, 2022 | A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor. |
| CVE-2021-25833 | Critical (9.8) | 44% | — | Mar 1, 2021 | A file extension handling issue was found in [server] module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file… |
| CVE-2021-25832 | Critical (9.8) | 13% | — | Mar 1, 2021 | A heap buffer overflow vulnerability inside of BMP image processing was found at [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability, an attacker is able to gain remote code executions… |
| CVE-2021-25831 | Critical (9.8) | 12% | — | Mar 1, 2021 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two… |
| CVE-2021-25830 | Critical (9.8) | 12% | — | Mar 1, 2021 | A file extension handling issue was found in [core] module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of… |
| CVE-2021-25829 | High (7.5) | 7.4% | — | Mar 1, 2021 | An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually… |
| CVE-2021-3199 | Critical (9.8) | 8.2% | — | Jan 26, 2021 | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter. |
| CVE-2020-11537 | Critical (9.8) | 1.5% | — | Apr 15, 2020 | A SQL Injection issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can execute arbitrary SQL queries via injection to DocID parameter of Websocket API. |
| CVE-2020-11536 | Critical (9.8) | 2.6% | — | Apr 15, 2020 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a binary and remotely execute code on a victim's server. |
| CVE-2020-11535 | Critical (9.8) | 2.3% | — | Apr 15, 2020 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary… |
| CVE-2020-11534 | Critical (9.8) | 2.2% | — | Apr 15, 2020 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the NSFileDownloader function to pass parameters to a binary (such as curl or wget) and remotely… |