Summary
generated automatically from NVD dataONLYOFFICE Document Server versions before 5.6.3 contain a directory traversal flaw (CWE-22) in the /upload endpoint when JWT is used. A /.. sequence in an image upload parameter lets an attacker escape the intended path, which can lead to remote code execution. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8, and it is listed in the CISA KEV catalog, meaning it is actively exploited.
NVD description
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-08. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-10-11
EPSS · FIRST.org
19.4%probability of exploitation in the next 30 days
Higher than 97% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 26 janv. 2021
- Updated
- 9 oct. 2026
- Status
- Analyzed
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (7)
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563Release NotesThird Party Advisory
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.pyExploitThird Party Advisory
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.pyExploitThird Party Advisory
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563Release NotesThird Party Advisory
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.pyExploitThird Party Advisory
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.pyExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-22
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.