MSRXMSRXSecurity
Vendors / ONLYOFFICE

ONLYOFFICE vulnerabilities being exploited

1 ONLYOFFICE flaw was confirmed exploited in the wild in the past 365 days, across 1 product: Docs. If you run any of them, patch these first.

AddedExploited vulnerabilityFix by
2026-10-08CVE-2021-3199 Docs
ONLYOFFICE Docs Server Path Traversal Vulnerability

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

2026-10-11
Watch my ONLYOFFICE softwareScan a websiteAll vendors

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.