Aggregates CVE and security vulnerability intelligence across all onlyoffice-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk input validation, vendor risk sql injection, and vendor risk ssrf and related problems; some flaws may lead to vendor impact session compromise and vendor impact memory corruption.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-68936 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer. | [email protected] | 6.4 | 0.18% | 2025-12-25 | 2026-06-17 |
| CVE-2025-68935 | ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer. | [email protected] | 6.4 | 0.18% | 2025-12-25 | 2026-06-17 |
| CVE-2025-68917 | ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer. | [email protected] | 6.4 | 0.15% | 2025-12-24 | 2026-06-17 |
| CVE-2023-46988 | Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating the fileExt parameter in the /example/editor endpoint, leading to unauthorized access to sensitive files and potential Denial of Service (DoS). | [email protected] | 6.7 | 0.46% | 2025-04-01 | 2026-06-17 |
| CVE-2024-44085 | ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. This is related to use of an immediately-invoked function expression (IIFE) for a macro. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446 and CVE-2023-50883. | [email protected] | 6.1 | 0.51% | 2024-09-09 | 2026-06-17 |
| CVE-2023-50883 | ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446. | [email protected] | 6.1 | 0.56% | 2024-09-09 | 2026-06-17 |
| CVE-2023-30188 | Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file. | [email protected] | 7.5 | 1.61% | 2023-08-14 | 2026-07-08 |
| CVE-2023-30187 | An out of bounds memory access vulnerability in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. | [email protected] | 9.8 | 1.73% | 2023-08-14 | 2026-07-08 |
| CVE-2023-30186 | A use after free issue discovered in ONLYOFFICE DocumentServer 4.0.3 through 7.3.2 allows remote attackers to run arbitrary code via crafted JavaScript file. | [email protected] | 9.8 | 1.68% | 2023-08-14 | 2026-07-08 |
| CVE-2023-34939 | Onlyoffice Community Server before v12.5.2 was discovered to contain a remote code execution (RCE) vulnerability via the component UploadProgress.ashx. | [email protected] | 9.8 | 5.03% | 2023-06-22 | 2026-06-17 |
| CVE-2022-48422 | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located. | [email protected] | 7.8 | 0.30% | 2023-03-18 | 2026-06-17 |
| CVE-2022-47412 | Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition. | [email protected] | 5.4 | 0.58% | 2023-02-07 | 2026-06-17 |
| CVE-2021-43449 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). The document editor service can be abused to read and serve arbitrary URLs as a document. | [email protected] | 8.1 | 1.25% | 2023-01-23 | 2026-06-17 |
| CVE-2021-43448 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known. | [email protected] | 5.3 | 1.01% | 2023-01-23 | 2026-06-17 |
| CVE-2021-43447 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the document editor allows attackers to edit documents without authentication. | [email protected] | 7.5 | 1.25% | 2023-01-23 | 2026-06-17 |
| CVE-2021-43446 | ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the document editor allows malicious cross site scripting payloads to be used. | [email protected] | 6.1 | 0.82% | 2023-01-23 | 2026-06-17 |
| CVE-2021-43445 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An attacker can authenticate with the web socket service of the ONLYOFFICE document editor which is protected by JWT auth by using a default JWT signing key. | [email protected] | 9.8 | 1.71% | 2023-01-23 | 2026-06-17 |
| CVE-2021-43444 | ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. Signed document download URLs can be forged due to a weak default URL signing key. | [email protected] | 7.5 | 1.20% | 2023-01-23 | 2026-06-17 |
| CVE-2022-29777 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/fontconverter/FontFileBase.h. | [email protected] | 9.8 | 6.85% | 2022-06-02 | 2026-06-17 |
| CVE-2022-29776 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File.cpp. | [email protected] | 9.8 | 6.85% | 2022-06-02 | 2026-06-17 |