HIGHVulnerability
Verified
Global

CISA KEV: ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.

Analysis

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. Added to CISA Known Exploited Vulnerabilities catalog on 2026-10-08. Remediation due: 2026-10-11.

Indicators of Compromise (1)

CVE (1)
CVE-2021-3199
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Oct 8, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerability

TiDB Breach Exposes Flawed Cloud Security Assumptions

Cloud providers may be storing sensitive customer data, without either party knowing it. But when a provider is breached, the data comes home to roost.

Dark Reading
MEDIUMVulnerability

Weak Certificates From Indian CA Cause Cascade of Updates

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/weak-certificates-from-indian-ca-cause-cascade-updates-image_small-2-a-33166.jpg" align=right hspace=4><b>eMudhra Says It Mistakenly Used Weak Certificates to Sign 8 Intermediary Certs</b><br>An Indian certificate authority revoked intermediate certificates after a researcher found it used a private encryption key that was only on

Bank Info Security
MEDIUMVulnerability

Utah OKs 3 Health-AI Pilot Apps for 'Regulatory Sandbox'

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/utah-approves-3-health-ai-pilots-for-regulatory-sandbox-image_small-6-a-33165.jpg" align=right hspace=4><b>Test Projects Focus on AI-Enabled Drug Prescriptions, Physical Therapy Treatment</b><br>Utah has given the green light for three more healthcare technology companies to test out how their AI systems can safely provide service

Bank Info Security