ONLYOFFICE Docs Server Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 08/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| document server | < 5.6.3 | 5.6.3 |
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free