CVE-2021-3199
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
Fix
CISA KEV required action · due 2026-10-11
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Added to the catalog 2026-10-08. CISA KEV
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 2
- EPSS0.20 → 0.30
- First seenCVSS 9.8 · in KEV · onlyofficeNVD modified 2026-10-09 14:20
Affected (CPE criteria) 1
cpe:2.3:a:onlyoffice:document_server:*:*:*:*:*:*:*:*
References 7
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 Release Notes, Third Party Advisory
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
- https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 Release Notes, Third Party Advisory
- https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
- https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3199 US Government Resource