OnlyOffice vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20242
3. 20255
4. 20262

Newest CVEs

• CVE-2026-110652

  ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass

  ONLYOFFICE · DocumentServer

  Medium6.3
• CVE-2026-110385

  A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to…

  ONLYOFFICE · Document Server

  High8.7
• CVE-2025-68936

  ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.

  ONLYOFFICE · Document Server

  Medium6.4
• CVE-2025-68935

  ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to DocumentServer.

  ONLYOFFICE · Document Server

  Medium6.4
• CVE-2025-68917

  ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.

  ONLYOFFICE · Document Server

  Medium6.4
• CVE-2025-6380

  ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function

  onlyoffice · ONLYOFFICE Docs

  Critical9.8
• CVE-2025-5301

  Reflected Cross-Site Scripting in ONLYOFFICE Docs (DocumentServer)

  OnlyOffice · Docs (DocumentServer)

  Medium6.1
• CVE-2024-11750

  ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

  onlyoffice · ONLYOFFICE DocSpace

  Medium6.4
• CVE-2024-11450

  ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

  onlyoffice · ONLYOFFICE Docs

  Medium6.4
• CVE-2022-47412

  ONLYOFFICE Workspace Search Stored XSS

  ONLYOFFICE · Workspace

  Medium5.4