HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-107781 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains ...

·Source: NIST NVD

Updated:

Executive Summary

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.

Analysis

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById. CVSS Score: 7.4. Published: 2026-10-08T21:17:53.080.

Indicators of Compromise (2)

SHA-1 (1)
003549ae5615bd114ba5bb8ddf6a8e8ead97c321
VirusTotalAnyRunJoe Sandbox
CVE (1)
CVE-2026-107781
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

LemFi adds credit and eSIM products

LemFi, the financial platform for people building lives across borders, today announced the launch of its new global brand platform, “Ambition has no passport”, alongside a completely rebuilt app, launching the largest product expansion in its history.

Finextra
LOWVulnerabilityNEW

CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)

CVE-2026-96652
The Hacker News
CRITICALVulnerabilityNEW

PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws

Tracked as CVE-2026-109618 and CVE-2026-109619, the bugs could potentially lead to unauthenticated remote code execution. The post PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws appeared first on SecurityWeek .

CVE-2026-109618CVE-2026-109619
SecurityWeek