ONLYOFFICE Docs Server Path Traversal Vulnerability

概要

参考情報

• ONLYOFFICE/DocumentServer · Release Notes
• moehw/poc_exploits · Exploit
• nola-milkin/poc_exploits · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2021-3199

document server のその他の脆弱性

• CVE-2025-68936中 6.1ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.
• CVE-2025-68935中 6.1ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.
• CVE-2023-46988中 6.7Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating th…
• CVE-2023-50883中 6.1ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape…
• CVE-2023-30188高 7.5Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via c…