AI analysis
Claude Opus · 5 Nov 2026, 10:21 CET
ONLYOFFICE Document Server upload flaw allows remote code execution, exploited in the wild
ONLYOFFICE Document Server before 5.6.3 has a path traversal flaw in its image upload function that can lead to remote code execution. CISA lists it as exploited. Upgrade to 5.6.3 or later and check exposed servers for compromise.
In plain terms
ONLYOFFICE Document Server is server software that lets people view and edit office documents in a web browser. It is often connected to file-sharing or collaboration platforms. Versions before 5.6.3 contain a path traversal flaw, meaning an attacker can trick the server into writing a file outside the folder it is supposed to use. Here this happens through the image upload feature, and according to the official description it can lead to remote code execution, so an attacker could run their own commands on the server.
Anyone running an older ONLYOFFICE Document Server, especially one reachable from the internet, should treat this as urgent. The flaw was first published in 2021, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has now confirmed that attackers are exploiting it.